Potential Password Spray Attack Uses Authentication Normalization

Back


Id	6a2e2ff4-5568-475e-bef2-b95f12b9367b
Rulename	Potential Password Spray Attack (Uses Authentication Normalization)
Description	This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack To use this analytics rule, make sure you have deployed the ASIM normalization parsers
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthPasswordSpray.yaml
Version	1.1.3
Arm template	6a2e2ff4-5568-475e-bef2-b95f12b9367b.json

KQL

let FailureThreshold = 15;
imAuthentication
| where EventType== 'Logon' and  EventResult== 'Failure'
// reason: creds 
| where EventResultDetails in ('No such user or password', 'Incorrect password')
| summarize UserCount=dcount(TargetUserId), Vendors=make_set(EventVendor), Products=make_set(EventVendor)
  , Users = make_set(TargetUserId,100) 
    by SrcDvcIpAddr, SrcGeoCountry, bin(TimeGenerated, 5m)
| where UserCount > FailureThreshold

YAML

severity: Medium
queryPeriod: 1h
name: Potential Password Spray Attack (Uses Authentication Normalization)
tags:
- version: 1.0.0
  Id: e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508
- Schema: ASIMAuthentication
  SchemaVersion: 0.1.0
entityMappings:
- fieldMappings:
  - columnName: SrcDvcIpAddr
    identifier: Address
  entityType: IP
version: 1.1.3
relevantTechniques:
- T1110
id: 6a2e2ff4-5568-475e-bef2-b95f12b9367b
queryFrequency: 1h
triggerThreshold: 0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthPasswordSpray.yaml
query: |
  let FailureThreshold = 15;
  imAuthentication
  | where EventType== 'Logon' and  EventResult== 'Failure'
  // reason: creds 
  | where EventResultDetails in ('No such user or password', 'Incorrect password')
  | summarize UserCount=dcount(TargetUserId), Vendors=make_set(EventVendor), Products=make_set(EventVendor)
    , Users = make_set(TargetUserId,100) 
      by SrcDvcIpAddr, SrcGeoCountry, bin(TimeGenerated, 5m)
  | where UserCount > FailureThreshold  
description: |
  'This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack
   To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'  
metadata:
  support:
    tier: Community
  categories:
    domains:
    - Security - Others
    - Identity
  author:
    name: Ofer Shezaf
  source:
    kind: Community
requiredDataConnectors: []
tactics:
- CredentialAccess
kind: Scheduled

ARM