Tenablead Password Spraying

Back


Id	29d350db-0ac0-4f4c-92ff-dac0f6335612
Rulename	Tenable.ad Password Spraying
Description	Searches for Password spraying attacks.
Severity	High
Tactics	CredentialAccess
Techniques	T1110.003
Required data connectors	Tenable.ad
Kind	Scheduled
Query frequency	2h
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/TenableAD/Analytic Rules/TenableAdPasswordSpraying.yaml
Version	1.0.1
Arm template	29d350db-0ac0-4f4c-92ff-dac0f6335612.json

KQL

// For the query to work properly, make sure you have imported the afad_parser.kql parser into the workspace
// Retrieve the parser here: https://raw.githubusercontent.com/tenable/Azure-Sentinel/Tenable.ad-connector/Solutions/TenableAD/Parsers/afad_parser.kql
// Then, create the Kusto Function with alias afad_parser
afad_parser
  | where MessageType == 2 and Codename == "Password Spraying"
  | extend HostName = tostring(split(Host, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))

YAML

queryPeriod: 2h
query: |
  // For the query to work properly, make sure you have imported the afad_parser.kql parser into the workspace
  // Retrieve the parser here: https://raw.githubusercontent.com/tenable/Azure-Sentinel/Tenable.ad-connector/Solutions/TenableAD/Parsers/afad_parser.kql
  // Then, create the Kusto Function with alias afad_parser
  afad_parser
    | where MessageType == 2 and Codename == "Password Spraying"
    | extend HostName = tostring(split(Host, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))  
name: Tenable.ad Password Spraying
entityMappings:
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: DnsDomain
    identifier: DnsDomain
  entityType: Host
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/TenableAD/Analytic Rules/TenableAdPasswordSpraying.yaml
requiredDataConnectors:
- connectorId: Tenable.ad
  dataTypes:
  - Tenable_ad_CL
description: |
    'Searches for Password spraying attacks.'
kind: Scheduled
version: 1.0.1
queryFrequency: 2h
severity: High
relevantTechniques:
- T1110.003
triggerOperator: gt
triggerThreshold: 0
tactics:
- CredentialAccess
id: 29d350db-0ac0-4f4c-92ff-dac0f6335612

ARM