EatonForeseer - Unauthorized Logins

Back


Id	5a7fccb8-3ed0-44f2-8477-540af3ef4d92
Rulename	EatonForeseer - Unauthorized Logins
Description	Detects Unauthorized Logins into Eaton Foreseer
Severity	High
Tactics	InitialAccess
Techniques	T1078
Required data connectors	WindowsSecurityEvents
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/EatonForeseer/Analytic Rules/EatonUnautorizedLogins.yaml
Version	1.0.0
Arm template	5a7fccb8-3ed0-44f2-8477-540af3ef4d92.json

KQL

SecurityEvent
// Look for all events relating to user logins
| where EventID in (4624,4625,4648,4675,4634,4647)
| where AccountType == "User"
// Filter for data present
| where isnotempty(TargetUserName)
// Look for all events that relate to the Eaton Foreseer application
| where ProcessName has "Foreseer"
// Ignore known user accounts (please edit based on your allowed users)
| where TargetUserName !in ("janedoe", "johndoe")
// De-duplicate multiple entries for the same user accessing a particular device
| summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer
| project
    TimeGenerated,
    IPCustomEntity = IpAddress,
    HostCustomEntity = Computer,
    UserEntity = TargetUserName,
    Process,
    ProcessName

YAML

query: |
  SecurityEvent
  // Look for all events relating to user logins
  | where EventID in (4624,4625,4648,4675,4634,4647)
  | where AccountType == "User"
  // Filter for data present
  | where isnotempty(TargetUserName)
  // Look for all events that relate to the Eaton Foreseer application
  | where ProcessName has "Foreseer"
  // Ignore known user accounts (please edit based on your allowed users)
  | where TargetUserName !in ("janedoe", "johndoe")
  // De-duplicate multiple entries for the same user accessing a particular device
  | summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer
  | project
      TimeGenerated,
      IPCustomEntity = IpAddress,
      HostCustomEntity = Computer,
      UserEntity = TargetUserName,
      Process,
      ProcessName  
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
- fieldMappings:
  - identifier: Name
    columnName: UserEntity
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: HostCustomEntity
  entityType: Host
- fieldMappings:
  - identifier: CommandLine
    columnName: Process
  entityType: Process
triggerOperator: gt
description: |
    'Detects Unauthorized Logins into Eaton Foreseer'
tactics:
- InitialAccess
severity: High
queryFrequency: 15m
kind: Scheduled
name: EatonForeseer - Unauthorized Logins
triggerThreshold: 0
status: Available
id: 5a7fccb8-3ed0-44f2-8477-540af3ef4d92
requiredDataConnectors:
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvent
relevantTechniques:
- T1078
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/EatonForeseer/Analytic Rules/EatonUnautorizedLogins.yaml
queryPeriod: 15m

ARM