EatonForeseer - Unauthorized Logins

Back


Id	5a7fccb8-3ed0-44f2-8477-540af3ef4d92
Rulename	EatonForeseer - Unauthorized Logins
Description	Detects Unauthorized Logins into Eaton Foreseer
Severity	High
Tactics	InitialAccess
Techniques	T1078
Required data connectors	WindowsSecurityEvents
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/EatonForeseer/Analytic Rules/EatonUnautorizedLogins.yaml
Version	1.0.0
Arm template	5a7fccb8-3ed0-44f2-8477-540af3ef4d92.json

KQL

SecurityEvent
// Look for all events relating to user logins
| where EventID in (4624,4625,4648,4675,4634,4647)
| where AccountType == "User"
// Filter for data present
| where isnotempty(TargetUserName)
// Look for all events that relate to the Eaton Foreseer application
| where ProcessName has "Foreseer"
// Ignore known user accounts (please edit based on your allowed users)
| where TargetUserName !in ("janedoe", "johndoe")
// De-duplicate multiple entries for the same user accessing a particular device
| summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer
| project
    TimeGenerated,
    IPCustomEntity = IpAddress,
    HostCustomEntity = Computer,
    UserEntity = TargetUserName,
    Process,
    ProcessName

YAML

relevantTechniques:
- T1078
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: UserEntity
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: Process
    identifier: CommandLine
  entityType: Process
triggerThreshold: 0
description: |
    'Detects Unauthorized Logins into Eaton Foreseer'
requiredDataConnectors:
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvent
triggerOperator: gt
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/EatonForeseer/Analytic Rules/EatonUnautorizedLogins.yaml
id: 5a7fccb8-3ed0-44f2-8477-540af3ef4d92
queryFrequency: 15m
query: |
  SecurityEvent
  // Look for all events relating to user logins
  | where EventID in (4624,4625,4648,4675,4634,4647)
  | where AccountType == "User"
  // Filter for data present
  | where isnotempty(TargetUserName)
  // Look for all events that relate to the Eaton Foreseer application
  | where ProcessName has "Foreseer"
  // Ignore known user accounts (please edit based on your allowed users)
  | where TargetUserName !in ("janedoe", "johndoe")
  // De-duplicate multiple entries for the same user accessing a particular device
  | summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer
  | project
      TimeGenerated,
      IPCustomEntity = IpAddress,
      HostCustomEntity = Computer,
      UserEntity = TargetUserName,
      Process,
      ProcessName  
severity: High
status: Available
queryPeriod: 15m
name: EatonForeseer - Unauthorized Logins
tactics:
- InitialAccess
kind: Scheduled

ARM