New country signIn with correct password

Back


Id	7808c05a-3afd-4d13-998a-a59e2297693f
Rulename	New country signIn with correct password
Description	Identifies an interrupted sign-in session from a country the user has not sign-in before in the last 7 days, where the password was correct. Although the session is interrupted by other controls such as multi factor authentication or conditional access policies, the user credentials should be reset due to logs indicating a correct password was observed during sign-in.
Severity	Medium
Tactics	InitialAccess CredentialAccess
Techniques	T1078 T1110
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	1d
Query period	7d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/NewCountryValidCreds.yaml
Version	1.0.2
Arm template	7808c05a-3afd-4d13-998a-a59e2297693f.json

KQL

// Creating a list of successful sign-in by users in the last 7 days.
let KnownUserCountry = (
SigninLogs
| where TimeGenerated between (ago(7d) .. ago(1d) ) 
| where ResultType == 0
| summarize KnownCountry = make_set(Location,1048576) by UserPrincipalName
);
// Identify sign-ins that are no successful but have the auth details indicating a correct password.
SigninLogs
| where TimeGenerated >= ago(1d)
| where ResultType != 0
| extend ParseAuth = parse_json(AuthenticationDetails)
| extend AuthMethod = tostring(ParseAuth.[0].authenticationMethod),
    PasswordResult = tostring(ParseAuth.[0].authenticationStepResultDetail),
    AuthSucceeded = tostring(ParseAuth.[0].succeeded)
| where PasswordResult == "Correct Password" or AuthSucceeded == "true"
| where AuthMethod == "Password"
| extend failureReason = tostring(Status.failureReason)
| summarize NewCountry = make_set(Location,1048576), LastObservedTime = max(TimeGenerated), AppName = make_set(AppDisplayName,1048576) by UserPrincipalName, PasswordResult, AuthSucceeded, failureReason
// Combining both tables by user
| join kind=inner KnownUserCountry on UserPrincipalName
// Compare both arrays and identify if the country has been observed in the past.
| extend CountryDiff = set_difference(NewCountry,KnownCountry)
| extend CountryDiffCount = array_length(CountryDiff)
// Count the new column to only alert if there is a difference between both arrays
| where CountryDiffCount != 0
| extend NewCountryEvent = CountryDiff
// Getting UserName and Domain
| extend Name = split(UserPrincipalName,"@",0),
    Domain = split(UserPrincipalName,"@",1)
| mv-expand Name,Domain

YAML

requiredDataConnectors:
- dataTypes:
  - SigninLogs
  connectorId: AzureActiveDirectory
queryPeriod: 7d
triggerThreshold: 0
queryFrequency: 1d
version: 1.0.2
severity: Medium
description: |
    'Identifies an interrupted sign-in session from a country the user has not sign-in before in the last 7 days, where the password was correct. Although the session is interrupted by other controls such as multi factor authentication or conditional access policies, the user credentials should be reset due to logs indicating a correct password was observed during sign-in.'
name: New country signIn with correct password
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: UserPrincipalName
  - identifier: Name
    columnName: Name
  - identifier: NTDomain
    columnName: Domain
  entityType: Account
triggerOperator: gt
id: 7808c05a-3afd-4d13-998a-a59e2297693f
eventGroupingSettings:
  aggregationKind: SingleAlert
tactics:
- InitialAccess
- CredentialAccess
relevantTechniques:
- T1078
- T1110
metadata:
  author:
    name: Juanse
  source:
    kind: Community
  categories:
    domains:
    - Identity
    - Security - Threat Protection
  support:
    tier: Community
customDetails:
  failureReason: failureReason
  NewCountryEvent: NewCountryEvent
  AuthSucceeded: AuthSucceeded
  PasswordResult: PasswordResult
  AppName: AppName
  LastObservedTime: LastObservedTime
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/NewCountryValidCreds.yaml
query: |
  // Creating a list of successful sign-in by users in the last 7 days.
  let KnownUserCountry = (
  SigninLogs
  | where TimeGenerated between (ago(7d) .. ago(1d) ) 
  | where ResultType == 0
  | summarize KnownCountry = make_set(Location,1048576) by UserPrincipalName
  );
  // Identify sign-ins that are no successful but have the auth details indicating a correct password.
  SigninLogs
  | where TimeGenerated >= ago(1d)
  | where ResultType != 0
  | extend ParseAuth = parse_json(AuthenticationDetails)
  | extend AuthMethod = tostring(ParseAuth.[0].authenticationMethod),
      PasswordResult = tostring(ParseAuth.[0].authenticationStepResultDetail),
      AuthSucceeded = tostring(ParseAuth.[0].succeeded)
  | where PasswordResult == "Correct Password" or AuthSucceeded == "true"
  | where AuthMethod == "Password"
  | extend failureReason = tostring(Status.failureReason)
  | summarize NewCountry = make_set(Location,1048576), LastObservedTime = max(TimeGenerated), AppName = make_set(AppDisplayName,1048576) by UserPrincipalName, PasswordResult, AuthSucceeded, failureReason
  // Combining both tables by user
  | join kind=inner KnownUserCountry on UserPrincipalName
  // Compare both arrays and identify if the country has been observed in the past.
  | extend CountryDiff = set_difference(NewCountry,KnownCountry)
  | extend CountryDiffCount = array_length(CountryDiff)
  // Count the new column to only alert if there is a difference between both arrays
  | where CountryDiffCount != 0
  | extend NewCountryEvent = CountryDiff
  // Getting UserName and Domain
  | extend Name = split(UserPrincipalName,"@",0),
      Domain = split(UserPrincipalName,"@",1)
  | mv-expand Name,Domain

ARM