Potential Password Spray Attack

Back


Id	64d16e62-1a17-4a35-9ea7-2b9fe6f07118
Rulename	Potential Password Spray Attack
Description	This query searches for failed attempts to log in from more than 15 various users within a 5 minutes timeframe from the same source. This is a potential indication of a password spray attack.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SalesforceServiceCloudCCPDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-PasswordSpray.yaml
Version	1.0.4
Arm template	64d16e62-1a17-4a35-9ea7-2b9fe6f07118.json

KQL

let FailureThreshold = 15;  
SalesforceServiceCloud
| where EventType =~ 'Login' and  LoginStatus != 'LOGIN_NO_ERROR'
| where LoginStatus  in~ ('LOGIN_ERROR_INVALID_PASSWORD', 'LOGIN_ERROR_SSO_PWD_INVALID')
| extend TimestampDerived = todatetime(TimestampDerived)
| summarize UserCount=dcount(UserId), Users = make_set(UserId,100) by ClientIp, bin(TimestampDerived, 5m)
| where UserCount > FailureThreshold

YAML

name: Potential Password Spray Attack
id: 64d16e62-1a17-4a35-9ea7-2b9fe6f07118
description: |
    'This query searches for failed attempts to log in from more than 15 various users within a 5 minutes timeframe from the same source. This is a potential indication of a password spray attack.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: ClientIp
    identifier: Address
  entityType: IP
version: 1.0.4
triggerOperator: gt
query: |
  let FailureThreshold = 15;  
  SalesforceServiceCloud
  | where EventType =~ 'Login' and  LoginStatus != 'LOGIN_NO_ERROR'
  | where LoginStatus  in~ ('LOGIN_ERROR_INVALID_PASSWORD', 'LOGIN_ERROR_SSO_PWD_INVALID')
  | extend TimestampDerived = todatetime(TimestampDerived)
  | summarize UserCount=dcount(UserId), Users = make_set(UserId,100) by ClientIp, bin(TimestampDerived, 5m)
  | where UserCount > FailureThreshold  
tactics:
- CredentialAccess
kind: Scheduled
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-PasswordSpray.yaml
severity: Medium
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - SalesforceServiceCloud
  connectorId: SalesforceServiceCloudCCPDefinition
status: Available
customDetails:
  Users: Users
relevantTechniques:
- T1110

ARM