Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Brute force attack against user credentials

Back
Id5a6ce089-e756-40fb-b022-c8e8864a973a
RulenameBrute force attack against user credentials
DescriptionIdentifies evidence of brute force activity against a user based on multiple authentication failures

and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses

The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.
SeverityMedium
TacticsCredentialAccess
TechniquesT1110
Required data connectorsSalesforceServiceCloud
KindScheduled
Query frequency20m
Query period20m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml
Version1.0.1
Arm template5a6ce089-e756-40fb-b022-c8e8864a973a.json
Deploy To Azure
let failureCountThreshold = 10;
let successCountThreshold = 1;
let Failures =
SalesforceServiceCloud
| where EventType == "Login" and LoginStatus != "LOGIN_NO_ERROR"
| summarize
      FailureStartTime = min(TimeGenerated),
      FailureEndTime = max(TimeGenerated),
      IpAddresses = make_set (ClientIp, 100),
      FailureCount = count() by User, UserId, UserType;
  SalesforceServiceCloud
  | where EventType == "Login" and LoginStatus == "LOGIN_NO_ERROR"
  | summarize
          SuccessStartTime = min(TimeGenerated),
          SuccessEndTime = max(TimeGenerated),
          IpAddresses = make_set (ClientIp, 100),
          SuccessCount = count() by User, UserId, UserType
  | join kind=leftouter Failures on UserId
  | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold
  | where FailureEndTime < SuccessStartTime
  | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses
requiredDataConnectors:
- connectorId: SalesforceServiceCloud
  dataTypes:
  - SalesforceServiceCloud
triggerOperator: gt
queryFrequency: 20m
name: Brute force attack against user credentials
status: Available
queryPeriod: 20m
id: 5a6ce089-e756-40fb-b022-c8e8864a973a
description: |
  'Identifies evidence of brute force activity against a user based on multiple authentication failures 
  and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses
  The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.'  
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml
query: |
  let failureCountThreshold = 10;
  let successCountThreshold = 1;
  let Failures =
  SalesforceServiceCloud
  | where EventType == "Login" and LoginStatus != "LOGIN_NO_ERROR"
  | summarize
        FailureStartTime = min(TimeGenerated),
        FailureEndTime = max(TimeGenerated),
        IpAddresses = make_set (ClientIp, 100),
        FailureCount = count() by User, UserId, UserType;
    SalesforceServiceCloud
    | where EventType == "Login" and LoginStatus == "LOGIN_NO_ERROR"
    | summarize
            SuccessStartTime = min(TimeGenerated),
            SuccessEndTime = max(TimeGenerated),
            IpAddresses = make_set (ClientIp, 100),
            SuccessCount = count() by User, UserId, UserType
    | join kind=leftouter Failures on UserId
    | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold
    | where FailureEndTime < SuccessStartTime
    | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses  
version: 1.0.1
kind: Scheduled
customDetails:
  IPAddresses: IpAddresses
  EventStartTime: FailureStartTime
  EventEndTime: SuccessEndTime
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: User
relevantTechniques:
- T1110
tactics:
- CredentialAccess
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5a6ce089-e756-40fb-b022-c8e8864a973a')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5a6ce089-e756-40fb-b022-c8e8864a973a')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Brute force attack against user credentials",
        "description": "'Identifies evidence of brute force activity against a user based on multiple authentication failures \nand at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses\nThe default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let failureCountThreshold = 10;\nlet successCountThreshold = 1;\nlet Failures =\nSalesforceServiceCloud\n| where EventType == \"Login\" and LoginStatus != \"LOGIN_NO_ERROR\"\n| summarize\n      FailureStartTime = min(TimeGenerated),\n      FailureEndTime = max(TimeGenerated),\n      IpAddresses = make_set (ClientIp, 100),\n      FailureCount = count() by User, UserId, UserType;\n  SalesforceServiceCloud\n  | where EventType == \"Login\" and LoginStatus == \"LOGIN_NO_ERROR\"\n  | summarize\n          SuccessStartTime = min(TimeGenerated),\n          SuccessEndTime = max(TimeGenerated),\n          IpAddresses = make_set (ClientIp, 100),\n          SuccessCount = count() by User, UserId, UserType\n  | join kind=leftouter Failures on UserId\n  | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold\n  | where FailureEndTime < SuccessStartTime\n  | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses\n",
        "queryFrequency": "PT20M",
        "queryPeriod": "PT20M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1110"
        ],
        "alertRuleTemplateName": "5a6ce089-e756-40fb-b022-c8e8864a973a",
        "customDetails": {
          "EventStartTime": "FailureStartTime",
          "IPAddresses": "IpAddresses",
          "EventEndTime": "SuccessEndTime"
        },
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "User"
              }
            ],
            "entityType": "Account"
          }
        ],
        "templateVersion": "1.0.1",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml",
        "status": "Available"
      }
    }
  ]
}