Silverfort - UserBruteForce Incident

Back


Id	46ff357b-9e98-465b-9e45-cd52fa4a7522
Rulename	Silverfort - UserBruteForce Incident
Description	A security weakness that allows attackers to gain unauthorized access to user accounts by systematically guessing the username and password combinations.
Severity	High
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SilverfortAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic Rules/User_Brute_Force.yaml
Version	1.0.0
Arm template	46ff357b-9e98-465b-9e45-cd52fa4a7522.json

KQL

CommonSecurityLog 
| where DeviceVendor has 'Silverfort'
| where DeviceProduct has 'Admin Console'
| where DeviceEventClassID == "NewIncident"
| where Message has "UserBruteForce"
| extend UserName = parse_json(replace('^""|""$', '', Message))['userName']

YAML

queryPeriod: 15m
description: |
    'A security weakness that allows attackers to gain unauthorized access to user accounts by systematically guessing the username and password combinations.'
relevantTechniques:
- T1110
triggerThreshold: 0
id: 46ff357b-9e98-465b-9e45-cd52fa4a7522
queryFrequency: 15m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic Rules/User_Brute_Force.yaml
kind: Scheduled
query: |-
  CommonSecurityLog 
  | where DeviceVendor has 'Silverfort'
  | where DeviceProduct has 'Admin Console'
  | where DeviceEventClassID == "NewIncident"
  | where Message has "UserBruteForce"
  | extend UserName = parse_json(replace('^""|""$', '', Message))['userName']  
entityMappings:
- fieldMappings:
  - columnName: UserName
    identifier: Name
  entityType: Account
triggerOperator: gt
tactics:
- CredentialAccess
name: Silverfort - UserBruteForce Incident
version: 1.0.0
severity: High
requiredDataConnectors:
- connectorId: SilverfortAma
  dataTypes:
  - CommonSecurityLog

ARM