Silverfort - Kerberos checksum mismatch | Microsoft Sentinel Analytic Rules

Back


Id	0bdbce35-83e8-5528-b57e-0d6f4a66a716
Rulename	Silverfort - Kerberos checksum mismatch
Description	Identifies Silverfort incidents involving Kerberos authentication failures caused by checksum mismatches. This behavior may indicate tampering or forged authentication packets.
Severity	High
Tactics	CredentialAccess
Techniques	T1558
Required data connectors	SilverfortAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/BadChecksum.yaml
Version	1.0.0
Arm template	0bdbce35-83e8-5528-b57e-0d6f4a66a716.json

KQL

CommonSecurityLog
| where DeviceVendor has 'Silverfort'
| where DeviceProduct has 'Admin Console'
| where DeviceEventClassID == "NewIncident"
| where Message has "BadChecksum"
| extend IncidentData = parse_json(replace('^""|""$', '', Message))
| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
| extend UserName = coalesce(
    tostring(IncidentData.data.users[0].samAccountName),
    tostring(IncidentData.data.users[0].upn),
    tostring(IncidentData.data.users[0].displayName),
    tostring(IncidentData.users[0].displayName)
)
| extend SourceHost = coalesce(
    tostring(IncidentData.data.sources[0].displayName),
    tostring(IncidentData.sources[0].displayName)
)
| extend DestinationHost = coalesce(
    tostring(IncidentData.data.destinations[0].displayName),
    tostring(IncidentData.destinations[0].displayName)
)

YAML

triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/BadChecksum.yaml
status: Available
query: |-
  CommonSecurityLog
  | where DeviceVendor has 'Silverfort'
  | where DeviceProduct has 'Admin Console'
  | where DeviceEventClassID == "NewIncident"
  | where Message has "BadChecksum"
  | extend IncidentData = parse_json(replace('^""|""$', '', Message))
  | extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
  | extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
  | extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
  | extend UserName = coalesce(
      tostring(IncidentData.data.users[0].samAccountName),
      tostring(IncidentData.data.users[0].upn),
      tostring(IncidentData.data.users[0].displayName),
      tostring(IncidentData.users[0].displayName)
  )
  | extend SourceHost = coalesce(
      tostring(IncidentData.data.sources[0].displayName),
      tostring(IncidentData.sources[0].displayName)
  )
  | extend DestinationHost = coalesce(
      tostring(IncidentData.data.destinations[0].displayName),
      tostring(IncidentData.destinations[0].displayName)
  )
kind: Scheduled
relevantTechniques:
- T1558
version: 1.0.0
tactics:
- CredentialAccess
id: 0bdbce35-83e8-5528-b57e-0d6f4a66a716
queryPeriod: 15m
queryFrequency: 15m
severity: High
name: Silverfort - Kerberos checksum mismatch
customDetails:
  IncidentReference: IncidentId
  IncidentSummary: IncidentSummary
  IncidentKind: IncidentKind
requiredDataConnectors:
- connectorId: SilverfortAma
  dataTypes:
  - CommonSecurityLog
description: |
  Identifies Silverfort incidents involving Kerberos authentication failures caused by checksum mismatches. This behavior may indicate tampering or forged authentication packets.
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: UserName
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: SourceHost
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DestinationHost
triggerThreshold: 0

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/0bdbce35-83e8-5528-b57e-0d6f4a66a716')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/0bdbce35-83e8-5528-b57e-0d6f4a66a716')]",
      "properties": {
        "alertRuleTemplateName": "0bdbce35-83e8-5528-b57e-0d6f4a66a716",
        "customDetails": {
          "IncidentKind": "IncidentKind",
          "IncidentReference": "IncidentId",
          "IncidentSummary": "IncidentSummary"
        },
        "description": "Identifies Silverfort incidents involving Kerberos authentication failures caused by checksum mismatches. This behavior may indicate tampering or forged authentication packets.\n",
        "displayName": "Silverfort - Kerberos checksum mismatch",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHost",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DestinationHost",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/BadChecksum.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| where DeviceEventClassID == \"NewIncident\"\n| where Message has \"BadChecksum\"\n| extend IncidentData = parse_json(replace('^\"\"|\"\"$', '', Message))\n| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))\n| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))\n| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))\n| extend UserName = coalesce(\n    tostring(IncidentData.data.users[0].samAccountName),\n    tostring(IncidentData.data.users[0].upn),\n    tostring(IncidentData.data.users[0].displayName),\n    tostring(IncidentData.users[0].displayName)\n)\n| extend SourceHost = coalesce(\n    tostring(IncidentData.data.sources[0].displayName),\n    tostring(IncidentData.sources[0].displayName)\n)\n| extend DestinationHost = coalesce(\n    tostring(IncidentData.data.destinations[0].displayName),\n    tostring(IncidentData.destinations[0].displayName)\n)",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1558"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}