Risky user signin observed in non-Microsoft network device

Back


Id	042f2801-a375-4cfd-bd29-041fc7ed88a0
Rulename	Risky user signin observed in non-Microsoft network device
Description	This content is utilized to identify instances of successful login by risky users, who have been observed engaging in potentially suspicious network activity on non-Microsoft network devices.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	AzureActiveDirectory CheckPoint Fortinet PaloAltoNetworks Zscaler
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/RiskyUserIn3Pnetworkactivity.yaml
Version	1.0.6
Arm template	042f2801-a375-4cfd-bd29-041fc7ed88a0.json

KQL

SigninLogs
//Find risky Signin
| where RiskState == "atRisk" and ResultType == 0
| extend Signin_Time = TimeGenerated
| summarize
    AppDisplayName=make_set(AppDisplayName),
    ClientAppUsed=make_set(ClientAppUsed),
    UserAgent=make_set(UserAgent),
    CorrelationId=make_set(CorrelationId),
    Signin_Time= min(Signin_Time),
    RiskEventTypes=make_set(RiskEventTypes)
    by
    ConditionalAccessStatus,
    IPAddress,
    IsRisky,
    ResourceDisplayName,
    RiskDetail,
    ResultType,
    RiskLevelAggregated,
    RiskLevelDuringSignIn,
    RiskState,
    UserPrincipalName=tostring(tolower(UserPrincipalName)),
    SourceSystem
| join kind=inner (
    CommonSecurityLog
    | where DeviceVendor has_any  ("Palo Alto Networks", "Fortinet", "Check Point", "Zscaler")
    | where DeviceProduct startswith "FortiGate" or DeviceProduct startswith  "PAN" or DeviceProduct startswith  "VPN" or DeviceProduct startswith "FireWall" or DeviceProduct startswith  "NSSWeblog" or DeviceProduct startswith "URL"
    | where DeviceAction != "Block"
    | where isnotempty(RequestURL)
    | where isnotempty(SourceUserName)
    | extend SourceUserName = tolower(SourceUserName)
    | summarize
        min(TimeGenerated),
        max(TimeGenerated),
        Activity=make_set(Activity)
        by DestinationHostName, DestinationIP, RequestURL, SourceUserName=tostring(tolower(SourceUserName)),DeviceVendor,DeviceProduct
    | extend 3p_observed_Time= min_TimeGenerated,Name = tostring(split(SourceUserName,"@")[0]),UPNSuffix =tostring(split(SourceUserName,"@")[1]))
    on $left.IPAddress == $right.DestinationIP and $left.UserPrincipalName == $right.SourceUserName
| extend Timediff = datetime_diff('day', 3p_observed_Time, Signin_Time)
| where Timediff <= 1 and Timediff >= 0

YAML

relevantTechniques:
- T1071
entityMappings:
- fieldMappings:
  - columnName: UserPrincipalName
    identifier: FullName
  - columnName: Name
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: DestinationIP
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: DestinationHostName
    identifier: DomainName
  entityType: DNS
triggerThreshold: 0
description: |
    'This content is utilized to identify instances of successful login by risky users, who have been observed engaging in potentially suspicious network activity on non-Microsoft network devices.'
metadata:
  author:
    name: Arjun Trivedi
  source:
    kind: Community
  categories:
    domains:
    - Security - Threat Protection
  support:
    tier: Community
requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - SigninLogs
- connectorId: PaloAltoNetworks
  dataTypes:
  - CommonSecurityLog (PaloAlto)
- connectorId: Fortinet
  dataTypes:
  - CommonSecurityLog (Fortinet)
- connectorId: CheckPoint
  dataTypes:
  - CommonSecurityLog (CheckPoint)
- connectorId: Zscaler
  dataTypes:
  - CommonSecurityLog (Zscaler)
triggerOperator: gt
version: 1.0.6
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/RiskyUserIn3Pnetworkactivity.yaml
id: 042f2801-a375-4cfd-bd29-041fc7ed88a0
queryFrequency: 1d
query: |
  SigninLogs
  //Find risky Signin
  | where RiskState == "atRisk" and ResultType == 0
  | extend Signin_Time = TimeGenerated
  | summarize
      AppDisplayName=make_set(AppDisplayName),
      ClientAppUsed=make_set(ClientAppUsed),
      UserAgent=make_set(UserAgent),
      CorrelationId=make_set(CorrelationId),
      Signin_Time= min(Signin_Time),
      RiskEventTypes=make_set(RiskEventTypes)
      by
      ConditionalAccessStatus,
      IPAddress,
      IsRisky,
      ResourceDisplayName,
      RiskDetail,
      ResultType,
      RiskLevelAggregated,
      RiskLevelDuringSignIn,
      RiskState,
      UserPrincipalName=tostring(tolower(UserPrincipalName)),
      SourceSystem
  | join kind=inner (
      CommonSecurityLog
      | where DeviceVendor has_any  ("Palo Alto Networks", "Fortinet", "Check Point", "Zscaler")
      | where DeviceProduct startswith "FortiGate" or DeviceProduct startswith  "PAN" or DeviceProduct startswith  "VPN" or DeviceProduct startswith "FireWall" or DeviceProduct startswith  "NSSWeblog" or DeviceProduct startswith "URL"
      | where DeviceAction != "Block"
      | where isnotempty(RequestURL)
      | where isnotempty(SourceUserName)
      | extend SourceUserName = tolower(SourceUserName)
      | summarize
          min(TimeGenerated),
          max(TimeGenerated),
          Activity=make_set(Activity)
          by DestinationHostName, DestinationIP, RequestURL, SourceUserName=tostring(tolower(SourceUserName)),DeviceVendor,DeviceProduct
      | extend 3p_observed_Time= min_TimeGenerated,Name = tostring(split(SourceUserName,"@")[0]),UPNSuffix =tostring(split(SourceUserName,"@")[1]))
      on $left.IPAddress == $right.DestinationIP and $left.UserPrincipalName == $right.SourceUserName
  | extend Timediff = datetime_diff('day', 3p_observed_Time, Signin_Time)
  | where Timediff <= 1 and Timediff >= 0  
severity: Medium
queryPeriod: 1d
name: Risky user signin observed in non-Microsoft network device
tactics:
- CommandAndControl
kind: Scheduled

ARM