Uniqkey - Excessive credential access | Microsoft Sentinel Analytic Rules

Back


Id	755c7adb-1015-4be3-9e56-55e72009c088
Rulename	Uniqkey - Excessive credential access
Description	Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization’s baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1555
Required data connectors	UniqkeyEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml
Version	1.0.0
Arm template	755c7adb-1015-4be3-9e56-55e72009c088.json

KQL

let threshold = 50;
UniqkeyEvents_CL
| where Category == "credential_access"
| summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType
| where AccessCount > threshold
| project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr

YAML

tactics:
- CredentialAccess
name: Uniqkey - Excessive credential access
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml
version: 1.0.0
queryFrequency: 1h
requiredDataConnectors:
- connectorId: UniqkeyEventsConnector
  dataTypes:
  - UniqkeyEvents_CL
id: 755c7adb-1015-4be3-9e56-55e72009c088
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ActorEmail
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
queryPeriod: 1h
severity: Medium
relevantTechniques:
- T1555
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionEnabled: false
description: "Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization's baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively."
triggerOperator: gt
suppressionDuration: 5h
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: true
    matchingMethod: AllEntities
    lookbackDuration: 1h
kind: Scheduled
query: |-
  let threshold = 50;
  UniqkeyEvents_CL
  | where Category == "credential_access"
  | summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType
  | where AccessCount > threshold
  | project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/755c7adb-1015-4be3-9e56-55e72009c088')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/755c7adb-1015-4be3-9e56-55e72009c088')]",
      "properties": {
        "alertRuleTemplateName": "755c7adb-1015-4be3-9e56-55e72009c088",
        "customDetails": null,
        "description": "Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization's baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively.",
        "displayName": "Uniqkey - Excessive credential access",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml",
        "query": "let threshold = 50;\nUniqkeyEvents_CL\n| where Category == \"credential_access\"\n| summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType\n| where AccessCount > threshold\n| project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1555"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}