EatonForeseer - Unauthorized Logins

Back


Id	5a7fccb8-3ed0-44f2-8477-540af3ef4d92
Rulename	EatonForeseer - Unauthorized Logins
Description	Detects Unauthorized Logins into Eaton Foreseer
Severity	High
Tactics	InitialAccess
Techniques	T1078
Required data connectors	WindowsSecurityEvents
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/EatonForeseer/Analytic Rules/EatonUnautorizedLogins.yaml
Version	1.0.0
Arm template	5a7fccb8-3ed0-44f2-8477-540af3ef4d92.json

KQL

SecurityEvent
// Look for all events relating to user logins
| where EventID in (4624,4625,4648,4675,4634,4647)
| where AccountType == "User"
// Filter for data present
| where isnotempty(TargetUserName)
// Look for all events that relate to the Eaton Foreseer application
| where ProcessName has "Foreseer"
// Ignore known user accounts (please edit based on your allowed users)
| where TargetUserName !in ("janedoe", "johndoe")
// De-duplicate multiple entries for the same user accessing a particular device
| summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer
| project
    TimeGenerated,
    IPCustomEntity = IpAddress,
    HostCustomEntity = Computer,
    UserEntity = TargetUserName,
    Process,
    ProcessName

YAML

query: |
  SecurityEvent
  // Look for all events relating to user logins
  | where EventID in (4624,4625,4648,4675,4634,4647)
  | where AccountType == "User"
  // Filter for data present
  | where isnotempty(TargetUserName)
  // Look for all events that relate to the Eaton Foreseer application
  | where ProcessName has "Foreseer"
  // Ignore known user accounts (please edit based on your allowed users)
  | where TargetUserName !in ("janedoe", "johndoe")
  // De-duplicate multiple entries for the same user accessing a particular device
  | summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer
  | project
      TimeGenerated,
      IPCustomEntity = IpAddress,
      HostCustomEntity = Computer,
      UserEntity = TargetUserName,
      Process,
      ProcessName  
kind: Scheduled
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: UserEntity
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: HostCustomEntity
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: Process
    identifier: CommandLine
  entityType: Process
description: |
    'Detects Unauthorized Logins into Eaton Foreseer'
version: 1.0.0
id: 5a7fccb8-3ed0-44f2-8477-540af3ef4d92
relevantTechniques:
- T1078
queryPeriod: 15m
queryFrequency: 15m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/EatonForeseer/Analytic Rules/EatonUnautorizedLogins.yaml
tactics:
- InitialAccess
severity: High
status: Available
requiredDataConnectors:
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvent
name: EatonForeseer - Unauthorized Logins
triggerOperator: gt

ARM