Brute force attack against user credentials
Id | 5a6ce089-e756-40fb-b022-c8e8864a973a |
Rulename | Brute force attack against user credentials |
Description | Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes. |
Severity | Medium |
Tactics | CredentialAccess |
Techniques | T1110 |
Required data connectors | SalesforceServiceCloud |
Kind | Scheduled |
Query frequency | 20m |
Query period | 20m |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml |
Version | 1.0.1 |
Arm template | 5a6ce089-e756-40fb-b022-c8e8864a973a.json |
let failureCountThreshold = 10;
let successCountThreshold = 1;
let Failures =
SalesforceServiceCloud
| where EventType == "Login" and LoginStatus != "LOGIN_NO_ERROR"
| summarize
FailureStartTime = min(TimeGenerated),
FailureEndTime = max(TimeGenerated),
IpAddresses = make_set (ClientIp, 100),
FailureCount = count() by User, UserId, UserType;
SalesforceServiceCloud
| where EventType == "Login" and LoginStatus == "LOGIN_NO_ERROR"
| summarize
SuccessStartTime = min(TimeGenerated),
SuccessEndTime = max(TimeGenerated),
IpAddresses = make_set (ClientIp, 100),
SuccessCount = count() by User, UserId, UserType
| join kind=leftouter Failures on UserId
| where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold
| where FailureEndTime < SuccessStartTime
| project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses
queryFrequency: 20m
entityMappings:
- entityType: Account
fieldMappings:
- columnName: User
identifier: FullName
severity: Medium
triggerThreshold: 0
relevantTechniques:
- T1110
query: |
let failureCountThreshold = 10;
let successCountThreshold = 1;
let Failures =
SalesforceServiceCloud
| where EventType == "Login" and LoginStatus != "LOGIN_NO_ERROR"
| summarize
FailureStartTime = min(TimeGenerated),
FailureEndTime = max(TimeGenerated),
IpAddresses = make_set (ClientIp, 100),
FailureCount = count() by User, UserId, UserType;
SalesforceServiceCloud
| where EventType == "Login" and LoginStatus == "LOGIN_NO_ERROR"
| summarize
SuccessStartTime = min(TimeGenerated),
SuccessEndTime = max(TimeGenerated),
IpAddresses = make_set (ClientIp, 100),
SuccessCount = count() by User, UserId, UserType
| join kind=leftouter Failures on UserId
| where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold
| where FailureEndTime < SuccessStartTime
| project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses
id: 5a6ce089-e756-40fb-b022-c8e8864a973a
triggerOperator: gt
version: 1.0.1
requiredDataConnectors:
- connectorId: SalesforceServiceCloud
dataTypes:
- SalesforceServiceCloud
customDetails:
IPAddresses: IpAddresses
EventStartTime: FailureStartTime
EventEndTime: SuccessEndTime
description: |
'Identifies evidence of brute force activity against a user based on multiple authentication failures
and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses
The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.'
queryPeriod: 20m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml
status: Available
name: Brute force attack against user credentials
tactics:
- CredentialAccess
kind: Scheduled
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5a6ce089-e756-40fb-b022-c8e8864a973a')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5a6ce089-e756-40fb-b022-c8e8864a973a')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01",
"properties": {
"displayName": "Brute force attack against user credentials",
"description": "'Identifies evidence of brute force activity against a user based on multiple authentication failures \nand at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses\nThe default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.'\n",
"severity": "Medium",
"enabled": true,
"query": "let failureCountThreshold = 10;\nlet successCountThreshold = 1;\nlet Failures =\nSalesforceServiceCloud\n| where EventType == \"Login\" and LoginStatus != \"LOGIN_NO_ERROR\"\n| summarize\n FailureStartTime = min(TimeGenerated),\n FailureEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n FailureCount = count() by User, UserId, UserType;\n SalesforceServiceCloud\n | where EventType == \"Login\" and LoginStatus == \"LOGIN_NO_ERROR\"\n | summarize\n SuccessStartTime = min(TimeGenerated),\n SuccessEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n SuccessCount = count() by User, UserId, UserType\n | join kind=leftouter Failures on UserId\n | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold\n | where FailureEndTime < SuccessStartTime\n | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses\n",
"queryFrequency": "PT20M",
"queryPeriod": "PT20M",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"CredentialAccess"
],
"techniques": [
"T1110"
],
"alertRuleTemplateName": "5a6ce089-e756-40fb-b022-c8e8864a973a",
"customDetails": {
"IPAddresses": "IpAddresses",
"EventEndTime": "SuccessEndTime",
"EventStartTime": "FailureStartTime"
},
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"identifier": "FullName",
"columnName": "User"
}
]
}
],
"status": "Available",
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-BruteForce.yaml",
"templateVersion": "1.0.1"
}
}
]
}