Claroty - Multiple failed logins to same destinations

Back


Id	1c2310ef-19bf-4caf-b2b0-a4c983932fa5
Rulename	Claroty - Multiple failed logins to same destinations
Description	Detects multiple failed login attempts to the same Claroty SRA destination site within a 5-minute window. The rule counts failed logins per site and alerts when the number of failures exceeds the threshold value of 10.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml
Version	1.0.4
Arm template	1c2310ef-19bf-4caf-b2b0-a4c983932fa5.json

KQL

let threshold = 10;
  ClarotyEvent
  | where EventType has 'Login to SRA'
  | where EventType !has 'succeeded'
  | extend Site = column_ifexists("site_name","")
  | where isnotempty(Site)
  | extend SrcUsername = extract(@'User\s(.*?)\sfailed', 1, EventMessage)
  | summarize FailedLogins = count(), SampleUser = any(SrcUsername) by Site, bin(TimeGenerated, 5m)
  | where FailedLogins > threshold
  | extend SGCustomEntity = Site
  | project TimeGenerated, Site, FailedLogins, Threshold = threshold, SampleUser, SGCustomEntity

YAML

name: Claroty - Multiple failed logins to same destinations
severity: High
description: Detects multiple failed login attempts to the same Claroty SRA destination site within a 5-minute window. The rule counts failed logins per site and alerts when the number of failures exceeds the threshold value of 10.
version: 1.0.4
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
tactics:
- InitialAccess
relevantTechniques:
- T1190
- T1133
entityMappings:
- entityType: SecurityGroup
  fieldMappings:
  - identifier: DistinguishedName
    columnName: SGCustomEntity
triggerThreshold: 0
status: Available
queryPeriod: 1h
kind: Scheduled
triggerOperator: gt
query: |
  let threshold = 10;
    ClarotyEvent
    | where EventType has 'Login to SRA'
    | where EventType !has 'succeeded'
    | extend Site = column_ifexists("site_name","")
    | where isnotempty(Site)
    | extend SrcUsername = extract(@'User\s(.*?)\sfailed', 1, EventMessage)
    | summarize FailedLogins = count(), SampleUser = any(SrcUsername) by Site, bin(TimeGenerated, 5m)
    | where FailedLogins > threshold
    | extend SGCustomEntity = Site
    | project TimeGenerated, Site, FailedLogins, Threshold = threshold, SampleUser, SGCustomEntity  
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml
id: 1c2310ef-19bf-4caf-b2b0-a4c983932fa5

ARM