EatonForeseer - Unauthorized Logins

Back


Id	5a7fccb8-3ed0-44f2-8477-540af3ef4d92
Rulename	EatonForeseer - Unauthorized Logins
Description	Detects Unauthorized Logins into Eaton Foreseer
Severity	High
Tactics	InitialAccess
Techniques	T1078
Required data connectors	WindowsSecurityEvents
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/EatonForeseer/Analytic Rules/EatonUnautorizedLogins.yaml
Version	1.0.0
Arm template	5a7fccb8-3ed0-44f2-8477-540af3ef4d92.json

KQL

SecurityEvent
// Look for all events relating to user logins
| where EventID in (4624,4625,4648,4675,4634,4647)
| where AccountType == "User"
// Filter for data present
| where isnotempty(TargetUserName)
// Look for all events that relate to the Eaton Foreseer application
| where ProcessName has "Foreseer"
// Ignore known user accounts (please edit based on your allowed users)
| where TargetUserName !in ("janedoe", "johndoe")
// De-duplicate multiple entries for the same user accessing a particular device
| summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer
| project
    TimeGenerated,
    IPCustomEntity = IpAddress,
    HostCustomEntity = Computer,
    UserEntity = TargetUserName,
    Process,
    ProcessName

YAML

requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
queryPeriod: 15m
triggerThreshold: 0
queryFrequency: 15m
version: 1.0.0
status: Available
severity: High
description: |
    'Detects Unauthorized Logins into Eaton Foreseer'
name: EatonForeseer - Unauthorized Logins
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
- fieldMappings:
  - identifier: Name
    columnName: UserEntity
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: HostCustomEntity
  entityType: Host
- fieldMappings:
  - identifier: CommandLine
    columnName: Process
  entityType: Process
triggerOperator: gt
id: 5a7fccb8-3ed0-44f2-8477-540af3ef4d92
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/EatonForeseer/Analytic Rules/EatonUnautorizedLogins.yaml
tactics:
- InitialAccess
relevantTechniques:
- T1078
kind: Scheduled
query: |
  SecurityEvent
  // Look for all events relating to user logins
  | where EventID in (4624,4625,4648,4675,4634,4647)
  | where AccountType == "User"
  // Filter for data present
  | where isnotempty(TargetUserName)
  // Look for all events that relate to the Eaton Foreseer application
  | where ProcessName has "Foreseer"
  // Ignore known user accounts (please edit based on your allowed users)
  | where TargetUserName !in ("janedoe", "johndoe")
  // De-duplicate multiple entries for the same user accessing a particular device
  | summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer
  | project
      TimeGenerated,
      IPCustomEntity = IpAddress,
      HostCustomEntity = Computer,
      UserEntity = TargetUserName,
      Process,
      ProcessName

ARM