Ping Federate - Password reset request from unexpected source IP address

Back


Id	2d201d21-77b4-4d97-95f3-26b5c6bde09f
Rulename	Ping Federate - Password reset request from unexpected source IP address..
Description	Detects password reset requests from unexpected source IP address.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederatePasswordRstReqUnexpectedSource.yaml
Version	1.0.3
Arm template	2d201d21-77b4-4d97-95f3-26b5c6bde09f.json

KQL

let known_src = 
PingFederateEvent
| where TimeGenerated between (ago(14d) .. (1d))
| where isnotempty(SrcIpAddr)
| summarize makeset(SrcIpAddr);
PingFederateEvent
| where EventType =~ 'PWD_RESET_REQUEST'
| where isnotempty(SrcIpAddr)
| where SrcIpAddr !in (known_src)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr

YAML

entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IpCustomEntity
  entityType: IP
kind: Scheduled
tactics:
- InitialAccess
query: |
  let known_src = 
  PingFederateEvent
  | where TimeGenerated between (ago(14d) .. (1d))
  | where isnotempty(SrcIpAddr)
  | summarize makeset(SrcIpAddr);
  PingFederateEvent
  | where EventType =~ 'PWD_RESET_REQUEST'
  | where isnotempty(SrcIpAddr)
  | where SrcIpAddr !in (known_src)
  | extend AccountCustomEntity = DstUserName
  | extend IpCustomEntity = SrcIpAddr  
name: Ping Federate - Password reset request from unexpected source IP address..
queryFrequency: 1h
queryPeriod: 14d
triggerThreshold: 0
triggerOperator: gt
severity: Medium
relevantTechniques:
- T1078
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
version: 1.0.3
status: Available
description: |
    'Detects password reset requests from unexpected source IP address.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederatePasswordRstReqUnexpectedSource.yaml
id: 2d201d21-77b4-4d97-95f3-26b5c6bde09f

ARM