Decoy User Account Authentication Attempt

Back


Id	a4dbc292-87eb-11ec-a8a3-0242ac120002
Rulename	Decoy User Account Authentication Attempt
Description	The query detects authentication attempts from a decoy user account. A decoy user account is explicitly created and monitored to alert the SOC, indicating a malicious activity when the account is in use.
Tactics	LateralMovement
Techniques	T1021
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	Scheduled
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Hunting Queries/DecoyUserAccountAuthenticationAttempt.yaml
Version	2.0.2
Arm template	a4dbc292-87eb-11ec-a8a3-0242ac120002.json

KQL

// Enter a reference list of decoy users (usernames) "Case Sensitive"
   let DecoyUserNameList = dynamic (["DecoyUser1","DecoyUser2"]);
SecurityEvent
 | where TargetUserName in (DecoyUserNameList)
 | where EventID in (4624,4625)
 | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, LogonTypeName, IpAddress
 | extend Account_0_Name = TargetUserName
 | extend Host_0_HostName = Computer
 | extend IP_0_Address = IpAddress

YAML

description: |
  'The query detects authentication attempts from a decoy user account. 
  A decoy user account is explicitly created and monitored to alert the SOC, indicating a malicious activity when the account is in use.'  
version: 2.0.2
id: a4dbc292-87eb-11ec-a8a3-0242ac120002
tactics:
- LateralMovement
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
query: |
  // Enter a reference list of decoy users (usernames) "Case Sensitive"
     let DecoyUserNameList = dynamic (["DecoyUser1","DecoyUser2"]);
  SecurityEvent
   | where TargetUserName in (DecoyUserNameList)
   | where EventID in (4624,4625)
   | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, TargetUserName, LogonTypeName, IpAddress
   | extend Account_0_Name = TargetUserName
   | extend Host_0_HostName = Computer
   | extend IP_0_Address = IpAddress    
name: Decoy User Account Authentication Attempt
entityMappings:
- fieldMappings:
  - columnName: TargetUserName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: Computer
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: IpAddress
    identifier: Address
  entityType: IP
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Hunting Queries/DecoyUserAccountAuthenticationAttempt.yaml
relevantTechniques:
- T1021

ARM