Cynerio - IoT - Weak password

Back


Id	65db1346-6435-4079-bbf4-9a7113c98054
Rulename	Cynerio - IoT - Weak password
Description	User signed in using weak credentials
Severity	High
Tactics	CredentialAccess
Techniques	T1552
Required data connectors	CynerioSecurityEvents
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic Rules/IoTWeakPasswords.yaml
Version	1.0.0
Arm template	65db1346-6435-4079-bbf4-9a7113c98054.json

KQL

CynerioEvent_CL
| where TimeGenerated > ago(24h)
| where module_s == 'IDS'
| where title_s == 'Weak Password'

YAML

query: |
  CynerioEvent_CL
  | where TimeGenerated > ago(24h)
  | where module_s == 'IDS'
  | where title_s == 'Weak Password'  
eventGroupingSettings:
  aggregationKind: SingleAlert
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic Rules/IoTWeakPasswords.yaml
requiredDataConnectors:
- dataTypes:
  - CynerioEvent_CL
  connectorId: CynerioSecurityEvents
id: 65db1346-6435-4079-bbf4-9a7113c98054
tactics:
- CredentialAccess
queryPeriod: 5h
queryFrequency: 5h
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: asset_ip_s
version: 1.0.0
customDetails:
  Service: service_s
triggerOperator: gt
relevantTechniques:
- T1552
severity: High
tags:
- Schema: ASimAuthentication
  SchemaVersion: 0.1.3
kind: Scheduled
name: Cynerio - IoT - Weak password
description: User signed in using weak credentials

ARM