Potential Password Spray Attack

Back


Id	64d16e62-1a17-4a35-9ea7-2b9fe6f07118
Rulename	Potential Password Spray Attack
Description	This query searches for failed attempts to log in from more than 15 various users within a 5 minutes timeframe from the same source. This is a potential indication of a password spray attack.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SalesforceServiceCloudCCPDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-PasswordSpray.yaml
Version	1.0.4
Arm template	64d16e62-1a17-4a35-9ea7-2b9fe6f07118.json

KQL

let FailureThreshold = 15;  
SalesforceServiceCloud
| where EventType =~ 'Login' and  LoginStatus != 'LOGIN_NO_ERROR'
| where LoginStatus  in~ ('LOGIN_ERROR_INVALID_PASSWORD', 'LOGIN_ERROR_SSO_PWD_INVALID')
| extend TimestampDerived = todatetime(TimestampDerived)
| summarize UserCount=dcount(UserId), Users = make_set(UserId,100) by ClientIp, bin(TimestampDerived, 5m)
| where UserCount > FailureThreshold

YAML

queryPeriod: 1h
query: |
  let FailureThreshold = 15;  
  SalesforceServiceCloud
  | where EventType =~ 'Login' and  LoginStatus != 'LOGIN_NO_ERROR'
  | where LoginStatus  in~ ('LOGIN_ERROR_INVALID_PASSWORD', 'LOGIN_ERROR_SSO_PWD_INVALID')
  | extend TimestampDerived = todatetime(TimestampDerived)
  | summarize UserCount=dcount(UserId), Users = make_set(UserId,100) by ClientIp, bin(TimestampDerived, 5m)
  | where UserCount > FailureThreshold  
name: Potential Password Spray Attack
entityMappings:
- fieldMappings:
  - columnName: ClientIp
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce Service Cloud/Analytic Rules/Salesforce-PasswordSpray.yaml
requiredDataConnectors:
- connectorId: SalesforceServiceCloudCCPDefinition
  dataTypes:
  - SalesforceServiceCloud
description: |
    'This query searches for failed attempts to log in from more than 15 various users within a 5 minutes timeframe from the same source. This is a potential indication of a password spray attack.'
kind: Scheduled
version: 1.0.4
status: Available
severity: Medium
relevantTechniques:
- T1110
triggerOperator: gt
triggerThreshold: 0
customDetails:
  Users: Users
tactics:
- CredentialAccess
id: 64d16e62-1a17-4a35-9ea7-2b9fe6f07118

ARM