API - Suspicious Login

Back


Id	7bdc10d6-aa24-4ca9-9a93-802cd8761354
Rulename	API - Suspicious Login
Description	42Crunch API protection against suspicious login
Severity	High
Tactics	CredentialAccess InitialAccess
Techniques	T1110 T1190
Required data connectors	42CrunchAPIProtection FortyTwoCrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APISuspiciousLogin.yaml
Version	3.0.1
Arm template	7bdc10d6-aa24-4ca9-9a93-802cd8761354.json

KQL

let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login?user=" and Status in (200, 403);
let ipAddressCount = toscalar(firstRec | summarize by SourceIp | count);
let secondRec = firstRec | summarize arg_max(TimeGenerated, *) by SourceIp;
let recCount = iff((toscalar(secondRec | count) > 3), ipAddressCount, 0);
secondRec | take recCount

YAML

triggerOperator: gt
kind: Scheduled
description: |
    '42Crunch API protection against suspicious login'
customDetails: 
version: 3.0.1
id: 7bdc10d6-aa24-4ca9-9a93-802cd8761354
name: API - Suspicious Login
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APISuspiciousLogin.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 5m
status: Available
query: |
  let firstRec = FortyTwoCrunchAPIProtection
  | where TimeGenerated >= ago(5m) 
  | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
  | where UriPath has "/api/login?user=" and Status in (200, 403);
  let ipAddressCount = toscalar(firstRec | summarize by SourceIp | count);
  let secondRec = firstRec | summarize arg_max(TimeGenerated, *) by SourceIp;
  let recCount = iff((toscalar(secondRec | count) > 3), ipAddressCount, 0);
  secondRec | take recCount  
triggerThreshold: 0
queryPeriod: 5m
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
relevantTechniques:
- T1110
- T1190
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SourceIp
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: Hostname
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: InstanceName
  entityType: Account
severity: High
tactics:
- CredentialAccess
- InitialAccess

ARM