Uniqkey - Excessive credential access | Microsoft Sentinel Analytic Rules

Back


Id	755c7adb-1015-4be3-9e56-55e72009c088
Rulename	Uniqkey - Excessive credential access
Description	Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization’s baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1555
Required data connectors	UniqkeyEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml
Version	1.0.0
Arm template	755c7adb-1015-4be3-9e56-55e72009c088.json

KQL

let threshold = 50;
UniqkeyEvents_CL
| where Category == "credential_access"
| summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType
| where AccessCount > threshold
| project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr

YAML

queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: ActorEmail
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 1h
    matchingMethod: AllEntities
    enabled: true
    reopenClosedIncident: false
triggerThreshold: 0
suppressionEnabled: false
triggerOperator: gt
severity: Medium
suppressionDuration: 5h
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml
query: |-
  let threshold = 50;
  UniqkeyEvents_CL
  | where Category == "credential_access"
  | summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType
  | where AccessCount > threshold
  | project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr
tactics:
- CredentialAccess
queryPeriod: 1h
relevantTechniques:
- T1555
requiredDataConnectors:
- connectorId: UniqkeyEventsConnector
  dataTypes:
  - UniqkeyEvents_CL
id: 755c7adb-1015-4be3-9e56-55e72009c088
version: 1.0.0
description: "Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization's baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively."
kind: Scheduled
name: Uniqkey - Excessive credential access

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/755c7adb-1015-4be3-9e56-55e72009c088')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/755c7adb-1015-4be3-9e56-55e72009c088')]",
      "properties": {
        "alertRuleTemplateName": "755c7adb-1015-4be3-9e56-55e72009c088",
        "customDetails": null,
        "description": "Detects an actor reading an abnormally large number of credentials from Uniqkey within a single hour (default threshold: more than 50 access events). Bulk credential reads are rarely part of normal daily work and can indicate a compromised session harvesting secrets, or an insider collecting credentials ahead of departure. Tune the threshold to your organization's baseline, and consider a lower threshold for actors of type scim or system that normally never read credentials interactively.",
        "displayName": "Uniqkey - Excessive credential access",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Excessive%20credential%20access.yaml",
        "query": "let threshold = 50;\nUniqkeyEvents_CL\n| where Category == \"credential_access\"\n| summarize AccessCount = count(), DistinctTargets = dcount(TargetId), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), SrcIpAddr = take_any(SrcIpAddr) by ActorEmail, ActorType\n| where AccessCount > threshold\n| project StartTime, EndTime, ActorEmail, ActorType, AccessCount, DistinctTargets, SrcIpAddr",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1555"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}