Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1555-credentials-from-password-stores

VIEW RULE IN DATADOG VIEW SIGNALS

Set up the 1password integration.

Goal

Detect when a 1Password user attempts to modify an item.

Strategy

This rule monitors 1Password audit logs to determine when the the enter-item-edit-mode item usage action occurs. This could indicate an attempt to modify an item.

Triage & response

1. Investigate the {{@usr.email}} attempting to modify item {{@item_uuid}} within vault {{@vault_uuid}}.
2. If this action was unintend by the user:
   • Rotate the user’s 1Password master password
   • Identify all the items that were modified and rotate the necessary authentication credentials