Potential Password Spray Attack Uses Authentication Normalization

Back


Id	6a2e2ff4-5568-475e-bef2-b95f12b9367b
Rulename	Potential Password Spray Attack (Uses Authentication Normalization)
Description	This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack To use this analytics rule, make sure you have deployed the ASIM normalization parsers
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthPasswordSpray.yaml
Version	1.1.3
Arm template	6a2e2ff4-5568-475e-bef2-b95f12b9367b.json

KQL

let FailureThreshold = 15;
imAuthentication
| where EventType== 'Logon' and  EventResult== 'Failure'
// reason: creds 
| where EventResultDetails in ('No such user or password', 'Incorrect password')
| summarize UserCount=dcount(TargetUserId), Vendors=make_set(EventVendor), Products=make_set(EventVendor)
  , Users = make_set(TargetUserId,100) 
    by SrcDvcIpAddr, SrcGeoCountry, bin(TimeGenerated, 5m)
| where UserCount > FailureThreshold

YAML

description: |
  'This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack
   To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'  
kind: Scheduled
tactics:
- CredentialAccess
requiredDataConnectors: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthPasswordSpray.yaml
severity: Medium
name: Potential Password Spray Attack (Uses Authentication Normalization)
metadata:
  support:
    tier: Community
  author:
    name: Ofer Shezaf
  categories:
    domains:
    - Security - Others
    - Identity
  source:
    kind: Community
triggerThreshold: 0
queryPeriod: 1h
query: |
  let FailureThreshold = 15;
  imAuthentication
  | where EventType== 'Logon' and  EventResult== 'Failure'
  // reason: creds 
  | where EventResultDetails in ('No such user or password', 'Incorrect password')
  | summarize UserCount=dcount(TargetUserId), Vendors=make_set(EventVendor), Products=make_set(EventVendor)
    , Users = make_set(TargetUserId,100) 
      by SrcDvcIpAddr, SrcGeoCountry, bin(TimeGenerated, 5m)
  | where UserCount > FailureThreshold  
relevantTechniques:
- T1110
id: 6a2e2ff4-5568-475e-bef2-b95f12b9367b
queryFrequency: 1h
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: SrcDvcIpAddr
    identifier: Address
triggerOperator: gt
version: 1.1.3
tags:
- Id: e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508
  version: 1.0.0
- Schema: ASIMAuthentication
  SchemaVersion: 0.1.0

ARM