Azure DevOps Personal Access Token (PAT) misuse

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This Alert detects whenever a PAT is used in ways that PATs are not normally used. May require an allow list and baselining. Reference - https://docs.microsoft.com/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page Use this query for baselining: ADOAuditLogs | distinct OperationName

Attribute Value
Type Analytic Rule
Solution AzureDevOpsAuditing
ID ac891683-53c3-4f86-86b4-c361708e2b2b
Severity High
Status Available
Kind Scheduled
Tactics Execution, Impact
Techniques T1496, T1559
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
ADOAuditLogs_CL ? ?
AzureDevOpsAuditing ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to AzureDevOpsAuditing