Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Ping Federate - Password reset request from unexpected source IP address

Back
Id2d201d21-77b4-4d97-95f3-26b5c6bde09f
RulenamePing Federate - Password reset request from unexpected source IP address..
DescriptionDetects password reset requests from unexpected source IP address.
SeverityMedium
TacticsInitialAccess
TechniquesT1078
Required data connectorsCefAma
KindScheduled
Query frequency1h
Query period14d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederatePasswordRstReqUnexpectedSource.yaml
Version1.0.3
Arm template2d201d21-77b4-4d97-95f3-26b5c6bde09f.json
Deploy To Azure
let known_src = 
PingFederateEvent
| where TimeGenerated between (ago(14d) .. (1d))
| where isnotempty(SrcIpAddr)
| summarize makeset(SrcIpAddr);
PingFederateEvent
| where EventType =~ 'PWD_RESET_REQUEST'
| where isnotempty(SrcIpAddr)
| where SrcIpAddr !in (known_src)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr
queryPeriod: 14d
status: Available
triggerOperator: gt
queryFrequency: 1h
description: |
    'Detects password reset requests from unexpected source IP address.'
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
query: |
  let known_src = 
  PingFederateEvent
  | where TimeGenerated between (ago(14d) .. (1d))
  | where isnotempty(SrcIpAddr)
  | summarize makeset(SrcIpAddr);
  PingFederateEvent
  | where EventType =~ 'PWD_RESET_REQUEST'
  | where isnotempty(SrcIpAddr)
  | where SrcIpAddr !in (known_src)
  | extend AccountCustomEntity = DstUserName
  | extend IpCustomEntity = SrcIpAddr  
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederatePasswordRstReqUnexpectedSource.yaml
tactics:
- InitialAccess
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: IpCustomEntity
    identifier: Address
  entityType: IP
relevantTechniques:
- T1078
name: Ping Federate - Password reset request from unexpected source IP address..
triggerThreshold: 0
id: 2d201d21-77b4-4d97-95f3-26b5c6bde09f
version: 1.0.3
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2d201d21-77b4-4d97-95f3-26b5c6bde09f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2d201d21-77b4-4d97-95f3-26b5c6bde09f')]",
      "properties": {
        "alertRuleTemplateName": "2d201d21-77b4-4d97-95f3-26b5c6bde09f",
        "customDetails": null,
        "description": "'Detects password reset requests from unexpected source IP address.'\n",
        "displayName": "Ping Federate - Password reset request from unexpected source IP address..",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IpCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederatePasswordRstReqUnexpectedSource.yaml",
        "query": "let known_src = \nPingFederateEvent\n| where TimeGenerated between (ago(14d) .. (1d))\n| where isnotempty(SrcIpAddr)\n| summarize makeset(SrcIpAddr);\nPingFederateEvent\n| where EventType =~ 'PWD_RESET_REQUEST'\n| where isnotempty(SrcIpAddr)\n| where SrcIpAddr !in (known_src)\n| extend AccountCustomEntity = DstUserName\n| extend IpCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}