User login from different countries within 3 hours (Uses Authentication Normalization)
Id | 09ec8fa2-b25f-4696-bfae-05a7b85d7b9e |
Rulename | User login from different countries within 3 hours (Uses Authentication Normalization) |
Description | This query searches for successful user logins from different countries within 3 hours. To use this analytics rule, make sure you have deployed the ASIM normalization parsers |
Severity | High |
Tactics | InitialAccess |
Techniques | T1078 |
Kind | Scheduled |
Query frequency | 3h |
Query period | 3h |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthSigninsMultipleCountries.yaml |
Version | 1.2.2 |
Arm template | 09ec8fa2-b25f-4696-bfae-05a7b85d7b9e.json |
let timeframe = ago(3h);
let threshold = 2;
imAuthentication
| where TimeGenerated > timeframe
| where EventType=='Logon' and EventResult=='Success'
| where isnotempty(SrcGeoCountry)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Vendors=make_set(EventVendor), Products=make_set(EventProduct)
, NumOfCountries = dcount(SrcGeoCountry)
by TargetUserId, TargetUsername, TargetUserType
| where NumOfCountries >= threshold
| extend timestamp = StartTime, AccountCustomEntity = TargetUsername
name: User login from different countries within 3 hours (Uses Authentication Normalization)
query: |
let timeframe = ago(3h);
let threshold = 2;
imAuthentication
| where TimeGenerated > timeframe
| where EventType=='Logon' and EventResult=='Success'
| where isnotempty(SrcGeoCountry)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Vendors=make_set(EventVendor), Products=make_set(EventProduct)
, NumOfCountries = dcount(SrcGeoCountry)
by TargetUserId, TargetUsername, TargetUserType
| where NumOfCountries >= threshold
| extend timestamp = StartTime, AccountCustomEntity = TargetUsername
metadata:
source:
kind: Community
author:
name: Ofer Shezaf
categories:
domains:
- Security - Network
support:
tier: Community
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthSigninsMultipleCountries.yaml
queryFrequency: 3h
triggerThreshold: 0
requiredDataConnectors: []
version: 1.2.2
queryPeriod: 3h
id: 09ec8fa2-b25f-4696-bfae-05a7b85d7b9e
triggerOperator: gt
entityMappings:
- fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
entityType: Account
tags:
- Id: 2954d424-f786-4677-9ffc-c24c44c6e7d5
version: 1.0.0
- Schema: ASIMAuthentication
SchemaVersion: 0.1.0
relevantTechniques:
- T1078
severity: High
description: |
'This query searches for successful user logins from different countries within 3 hours.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
kind: Scheduled
tactics:
- InitialAccess
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/09ec8fa2-b25f-4696-bfae-05a7b85d7b9e')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/09ec8fa2-b25f-4696-bfae-05a7b85d7b9e')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01",
"properties": {
"displayName": "User login from different countries within 3 hours (Uses Authentication Normalization)",
"description": "'This query searches for successful user logins from different countries within 3 hours.\n To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'\n",
"severity": "High",
"enabled": true,
"query": "let timeframe = ago(3h);\nlet threshold = 2;\nimAuthentication\n| where TimeGenerated > timeframe\n| where EventType=='Logon' and EventResult=='Success'\n| where isnotempty(SrcGeoCountry)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Vendors=make_set(EventVendor), Products=make_set(EventProduct)\n , NumOfCountries = dcount(SrcGeoCountry)\n by TargetUserId, TargetUsername, TargetUserType\n| where NumOfCountries >= threshold\n| extend timestamp = StartTime, AccountCustomEntity = TargetUsername\n",
"queryFrequency": "PT3H",
"queryPeriod": "PT3H",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"InitialAccess"
],
"techniques": [
"T1078"
],
"alertRuleTemplateName": "09ec8fa2-b25f-4696-bfae-05a7b85d7b9e",
"customDetails": null,
"entityMappings": [
{
"fieldMappings": [
{
"identifier": "FullName",
"columnName": "AccountCustomEntity"
}
],
"entityType": "Account"
}
],
"tags": [
{
"Id": "2954d424-f786-4677-9ffc-c24c44c6e7d5",
"version": "1.0.0"
},
{
"SchemaVersion": "0.1.0",
"Schema": "ASIMAuthentication"
}
],
"templateVersion": "1.2.2",
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthSigninsMultipleCountries.yaml"
}
}
]
}