Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Admin password not updated in 30 days

Back
Id63d87fcb-d197-48d2-a642-de4813f0219a
RulenameAdmin password not updated in 30 days
DescriptionThe policy detects an administrative account where the password of the account was not updated in the last 30 days.
SeverityMedium
TacticsInitialAccess
TechniquesT1078
Required data connectorsAuthomize
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_password_wasnt_updated.yaml
Version1.0.2
Arm template63d87fcb-d197-48d2-a642-de4813f0219a.json
Deploy To Azure
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "Admin password wasn't updated during the last 30 days"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
description: The policy detects an administrative account where the password of the account was not updated in the last 30 days.
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: URL
  entityType: URL
queryFrequency: 30m
triggerOperator: gt
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByCustomDetails: []
    groupByEntities: []
    reopenClosedIncident: false
    enabled: true
    lookbackDuration: 5h
    groupByAlertDetails: []
    matchingMethod: AnyAlert
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: SingleAlert
suppressionEnabled: false
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_password_wasnt_updated.yaml
query: |-
  Authomize_v2_CL
  | where ingestion_time() >= ago(30m)
  | extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
  | where Policy has "Admin password wasn't updated during the last 30 days"
  | project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics  
queryPeriod: 30m
version: 1.0.2
relevantTechniques:
- T1078
id: 63d87fcb-d197-48d2-a642-de4813f0219a
requiredDataConnectors:
- connectorId: Authomize
  dataTypes:
  - Authomize_v2_CL
kind: Scheduled
name: Admin password not updated in 30 days
tactics:
- InitialAccess
triggerThreshold: 0
severity: Medium
alertDetailsOverride:
  alertnameFormat: Alert from Authomize - Admin password wasn't updated during the last 30 days
  alertDescriptionFormat: |
        Admin password wasn't updated during the last 30 days. The policy detects admin account where password wasn't updated during the last 30 days.
  alertDynamicProperties:
  - value: URL
    alertProperty: AlertLink
  alertSeverity: Severity
  alertTactics: Tactics
status: Available
customDetails:
  AuthomizeEventID: EventID
  EventRecommendation: Recommendation
  EventDescription: Description
  ReferencedURL: URL
  EventName: Policy
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/63d87fcb-d197-48d2-a642-de4813f0219a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/63d87fcb-d197-48d2-a642-de4813f0219a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Admin password wasn't updated during the last 30 days. The policy detects admin account where password wasn't updated during the last 30 days.\n",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "URL"
            }
          ],
          "alertnameFormat": "Alert from Authomize - Admin password wasn't updated during the last 30 days",
          "alertSeverity": "Severity",
          "alertTactics": "Tactics"
        },
        "alertRuleTemplateName": "63d87fcb-d197-48d2-a642-de4813f0219a",
        "customDetails": {
          "AuthomizeEventID": "EventID",
          "EventDescription": "Description",
          "EventName": "Policy",
          "EventRecommendation": "Recommendation",
          "ReferencedURL": "URL"
        },
        "description": "The policy detects an administrative account where the password of the account was not updated in the last 30 days.",
        "displayName": "Admin password not updated in 30 days",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/Admin_password_wasnt_updated.yaml",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s\n| where Policy has \"Admin password wasn't updated during the last 30 days\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}