PulseConnectSecure - Potential Brute Force Attempts

Back


Id	34663177-8abf-4db1-b0a4-5683ab273f44
Rulename	PulseConnectSecure - Potential Brute Force Attempts
Description	This query identifies evidence of potential brute force attack by looking at multiple failed attempts to log into the VPN server
Severity	Low
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pulse Connect Secure/Analytic Rules/PulseConnectSecureVPN-BruteForce.yaml
Version	1.0.4
Arm template	34663177-8abf-4db1-b0a4-5683ab273f44.json

KQL

let threshold = 20;
PulseConnectSecure
| where Messages contains "Login failed"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by User, Source_IP
| where count_ > threshold

YAML

relevantTechniques:
- T1110
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: User
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: Source_IP
    identifier: Address
version: 1.0.4
id: 34663177-8abf-4db1-b0a4-5683ab273f44
severity: Low
kind: Scheduled
queryFrequency: 1h
description: |
    'This query identifies evidence of potential brute force attack by looking at multiple failed attempts to log into the VPN server'
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerOperator: gt
name: PulseConnectSecure - Potential Brute Force Attempts
tactics:
- CredentialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Pulse Connect Secure/Analytic Rules/PulseConnectSecureVPN-BruteForce.yaml
triggerThreshold: 0
queryPeriod: 1h
query: |
  let threshold = 20;
  PulseConnectSecure
  | where Messages contains "Login failed"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by User, Source_IP
  | where count_ > threshold  
status: Available

ARM