Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Claroty - Multiple failed logins to same destinations

Back
Id1c2310ef-19bf-4caf-b2b0-a4c983932fa5
RulenameClaroty - Multiple failed logins to same destinations
DescriptionDetects multiple failed logins to same destinations.
SeverityHigh
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsClaroty
ClarotyAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml
Version1.0.1
Arm template1c2310ef-19bf-4caf-b2b0-a4c983932fa5.json
Deploy To Azure
let threshold = 10;
ClarotyEvent
| where EventType has 'Login to SRA'
| where EventType !has 'succeeded'
| extend Site = column_ifexists("site_name","")
| where isnotempty(Site)
| extend SrcUsername = extract(@'User\s(.*?)\sfailed', 1, EventMessage)
| summarize count() by Site, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend SGCustomEntity = Site
severity: High
name: Claroty - Multiple failed logins to same destinations
requiredDataConnectors:
- dataTypes:
  - ClarotyEvent
  connectorId: Claroty
- dataTypes:
  - ClarotyEvent
  connectorId: ClarotyAma
id: 1c2310ef-19bf-4caf-b2b0-a4c983932fa5
tactics:
- InitialAccess
queryFrequency: 1h
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml
description: |
    'Detects multiple failed logins to same destinations.'
triggerThreshold: 0
kind: Scheduled
relevantTechniques:
- T1190
- T1133
query: |
  let threshold = 10;
  ClarotyEvent
  | where EventType has 'Login to SRA'
  | where EventType !has 'succeeded'
  | extend Site = column_ifexists("site_name","")
  | where isnotempty(Site)
  | extend SrcUsername = extract(@'User\s(.*?)\sfailed', 1, EventMessage)
  | summarize count() by Site, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend SGCustomEntity = Site  
entityMappings:
- entityType: SecurityGroup
  fieldMappings:
  - columnName: SGCustomEntity
    identifier: DistinguishedName
status: Available
version: 1.0.1
queryPeriod: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1c2310ef-19bf-4caf-b2b0-a4c983932fa5')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1c2310ef-19bf-4caf-b2b0-a4c983932fa5')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Claroty - Multiple failed logins to same destinations",
        "description": "'Detects multiple failed logins to same destinations.'\n",
        "severity": "High",
        "enabled": true,
        "query": "let threshold = 10;\nClarotyEvent\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend Site = column_ifexists(\"site_name\",\"\")\n| where isnotempty(Site)\n| extend SrcUsername = extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)\n| summarize count() by Site, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend SGCustomEntity = Site\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1133"
        ],
        "alertRuleTemplateName": "1c2310ef-19bf-4caf-b2b0-a4c983932fa5",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "DistinguishedName",
                "columnName": "SGCustomEntity"
              }
            ],
            "entityType": "SecurityGroup"
          }
        ],
        "status": "Available",
        "templateVersion": "1.0.1",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml"
      }
    }
  ]
}