Uniqkey - Excessive credential access | Microsoft Sentinel Analytic Rules

Back


Id	755c7adb-1015-4be3-9e56-55e72009c088
Rulename	Uniqkey - Excessive credential access
Description	Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization’s baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1555
Required data connectors	UniqkeyEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml
Version	1.0.0
Arm template	755c7adb-1015-4be3-9e56-55e72009c088.json

KQL

let threshold = 50;
UniqkeyEvents_CL
| where Category == "credential_access"
| summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType
| where AccessCount > threshold
| project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr

YAML

incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: true
    lookbackDuration: 1h
    reopenClosedIncident: false
  createIncident: true
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml
triggerThreshold: 0
id: 755c7adb-1015-4be3-9e56-55e72009c088
suppressionEnabled: false
kind: Scheduled
queryPeriod: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- CredentialAccess
queryFrequency: 1h
severity: Medium
name: Uniqkey - Excessive credential access
requiredDataConnectors:
- connectorId: UniqkeyEventsConnector
  dataTypes:
  - UniqkeyEvents_CL
version: 1.0.0
relevantTechniques:
- T1555
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorEmail
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
query: |-
  let threshold = 50;
  UniqkeyEvents_CL
  | where Category == "credential_access"
  | summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType
  | where AccessCount > threshold
  | project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr
suppressionDuration: 5h
description: "Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization's baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively."

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/755c7adb-1015-4be3-9e56-55e72009c088')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/755c7adb-1015-4be3-9e56-55e72009c088')]",
      "properties": {
        "alertRuleTemplateName": "755c7adb-1015-4be3-9e56-55e72009c088",
        "customDetails": null,
        "description": "Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization's baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively.",
        "displayName": "Uniqkey - Excessive credential access",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml",
        "query": "let threshold = 50;\nUniqkeyEvents_CL\n| where Category == \"credential_access\"\n| summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType\n| where AccessCount > threshold\n| project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1555"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}