Semperis DSP Failed Logons

Back


Id	0e105444-fe13-4ce6-9239-21880076a3f9
Rulename	Semperis DSP Failed Logons
Description	Alerts when there are failed logons in the DSP system.
Severity	Medium
Tactics	InitialAccess CredentialAccess
Techniques	T1078 T1110
Required data connectors	SemperisDSP
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Failed_Logons.yaml
Version	2.0.7
Arm template	0e105444-fe13-4ce6-9239-21880076a3f9.json

KQL

SecurityEvent
| where EventSourceName == 'Semperis-Operation-Log' and EventID == 20002
| sort by TimeGenerated desc 
| extend p1Xml = parse_xml(EventData).EventData.Data
| mv-expand bagexpansion=array p1Xml
| evaluate bag_unpack(p1Xml)
| extend Name=column_ifexists('@Name', ''), Value=column_ifexists('#text', '')
| evaluate pivot(Name, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)
| extend det = column_ifexists('details', '')
| parse det with * "Trustee Name: " TrusteeName " Correlation ID: " * " Source: " HostIP "WebSite Target" *
| extend host = tostring(HostIP)
| extend HostIP = trim_end(":", HostIP)
| project TimeGenerated, TrusteeName, HostIP, _ResourceId
| extend NTDomain = tostring(split(TrusteeName, '\\', 0)[0]), Name = tostring(split(TrusteeName, '\\', 1)[0])

YAML

severity: Medium
relevantTechniques:
- T1078
- T1110
requiredDataConnectors:
- dataTypes:
  - dsp_parser
  connectorId: SemperisDSP
status: Available
triggerThreshold: 0
description: |
    'Alerts when there are failed logons in the DSP system.'
triggerOperator: gt
alertDetailsOverride:
  alertDescriptionFormat: A failed logon was detected to the DSP system.
  alertDisplayNameFormat: Failed Logon -- Alert from Semperis Directory Services Protector
name: Semperis DSP Failed Logons
queryFrequency: 30m
version: 2.0.7
kind: Scheduled
query: |
  SecurityEvent
  | where EventSourceName == 'Semperis-Operation-Log' and EventID == 20002
  | sort by TimeGenerated desc 
  | extend p1Xml = parse_xml(EventData).EventData.Data
  | mv-expand bagexpansion=array p1Xml
  | evaluate bag_unpack(p1Xml)
  | extend Name=column_ifexists('@Name', ''), Value=column_ifexists('#text', '')
  | evaluate pivot(Name, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)
  | extend det = column_ifexists('details', '')
  | parse det with * "Trustee Name: " TrusteeName " Correlation ID: " * " Source: " HostIP "WebSite Target" *
  | extend host = tostring(HostIP)
  | extend HostIP = trim_end(":", HostIP)
  | project TimeGenerated, TrusteeName, HostIP, _ResourceId
  | extend NTDomain = tostring(split(TrusteeName, '\\', 0)[0]), Name = tostring(split(TrusteeName, '\\', 1)[0])   
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: HostIP
    identifier: Address
- entityType: Account
  fieldMappings:
  - columnName: Name
    identifier: Name
  - columnName: NTDomain
    identifier: NTDomain
tactics:
- InitialAccess
- CredentialAccess
queryPeriod: 30m
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Failed_Logons.yaml
id: 0e105444-fe13-4ce6-9239-21880076a3f9

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/0e105444-fe13-4ce6-9239-21880076a3f9')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/0e105444-fe13-4ce6-9239-21880076a3f9')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A failed logon was detected to the DSP system.",
          "alertDisplayNameFormat": "Failed Logon -- Alert from Semperis Directory Services Protector"
        },
        "alertRuleTemplateName": "0e105444-fe13-4ce6-9239-21880076a3f9",
        "customDetails": null,
        "description": "'Alerts when there are failed logons in the DSP system.'\n",
        "displayName": "Semperis DSP Failed Logons",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "HostIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "Name",
                "identifier": "Name"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Semperis Directory Services Protector/Analytic Rules/Semperis_DSP_Failed_Logons.yaml",
        "query": "SecurityEvent\n| where EventSourceName == 'Semperis-Operation-Log' and EventID == 20002\n| sort by TimeGenerated desc \n| extend p1Xml = parse_xml(EventData).EventData.Data\n| mv-expand bagexpansion=array p1Xml\n| evaluate bag_unpack(p1Xml)\n| extend Name=column_ifexists('@Name', ''), Value=column_ifexists('#text', '')\n| evaluate pivot(Name, any(Value), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\n| extend det = column_ifexists('details', '')\n| parse det with * \"Trustee Name: \" TrusteeName \" Correlation ID: \" * \" Source: \" HostIP \"WebSite Target\" *\n| extend host = tostring(HostIP)\n| extend HostIP = trim_end(\":\", HostIP)\n| project TimeGenerated, TrusteeName, HostIP, _ResourceId\n| extend NTDomain = tostring(split(TrusteeName, '\\\\', 0)[0]), Name = tostring(split(TrusteeName, '\\\\', 1)[0]) \n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1110"
        ],
        "templateVersion": "2.0.7",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}