Cynerio - IoT - Default password

Back


Id	84e0ea1f-766d-4775-836a-c0c9cca05085
Rulename	Cynerio - IoT - Default password
Description	User signed in using default credentials
Severity	High
Tactics	CredentialAccess
Techniques	T1552
Required data connectors	CynerioSecurityEvents
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic Rules/IoTDefaultPasswords.yaml
Version	1.0.0
Arm template	84e0ea1f-766d-4775-836a-c0c9cca05085.json

KQL

CynerioEvent_CL
| where TimeGenerated > ago(24h)
| where module_s == 'IDS'
| where title_s == 'Default Password'

YAML

queryPeriod: 5h
query: |
  CynerioEvent_CL
  | where TimeGenerated > ago(24h)
  | where module_s == 'IDS'
  | where title_s == 'Default Password'  
name: Cynerio - IoT - Default password
entityMappings:
- fieldMappings:
  - columnName: asset_ip_s
    identifier: Address
  entityType: IP
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic Rules/IoTDefaultPasswords.yaml
tags:
- SchemaVersion: 0.1.3
  Schema: ASimAuthentication
requiredDataConnectors:
- connectorId: CynerioSecurityEvents
  dataTypes:
  - CynerioEvent_CL
description: User signed in using default credentials
kind: Scheduled
version: 1.0.0
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 5h
severity: High
relevantTechniques:
- T1552
triggerOperator: gt
triggerThreshold: 0
customDetails:
  Service: service_s
tactics:
- CredentialAccess
id: 84e0ea1f-766d-4775-836a-c0c9cca05085

ARM