Failed Logins from Unknown or Invalid User

Back


Id	884be6e7-e568-418e-9c12-89229865ffde
Rulename	Failed Logins from Unknown or Invalid User
Description	This query searches for numerous login attempts to the management console with an unknown or invalid user name.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	OktaSSO OktaSSOv2
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/FailedLoginsFromUnknownOrInvalidUser.yaml
Version	1.1.1
Arm template	884be6e7-e568-418e-9c12-89229865ffde.json

KQL

let FailureThreshold = 15;
let FailedLogins = OktaSSO
| where eventType_s =~ "user.session.start" and outcome_reason_s =~ "VERIFICATION_ERROR"
| summarize count() by actor_alternateId_s, client_ipAddress_s, bin(TimeGenerated, 5m)
| where count_ > FailureThreshold
| project client_ipAddress_s, actor_alternateId_s;
OktaSSO
| join kind=inner (FailedLogins) on client_ipAddress_s, actor_alternateId_s
| where eventType_s =~ "user.session.start" and outcome_reason_s =~ "VERIFICATION_ERROR"
| summarize count() by actor_alternateId_s, ClientIP = client_ipAddress_s, City = column_ifexists('client_geographicalContext_city_s', ""), Country = column_ifexists('client_geographicalContext_country_s', ""), column_ifexists('published_t', now())
| sort by column_ifexists('published_t', now()) desc

YAML

relevantTechniques:
- T1110
entityMappings:
- fieldMappings:
  - columnName: actor_alternateId_s
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: ClientIP
    identifier: Address
  entityType: IP
triggerThreshold: 0
description: |
    'This query searches for numerous login attempts to the management console with an unknown or invalid user name.'
requiredDataConnectors:
- connectorId: OktaSSO
  dataTypes:
  - Okta_CL
- connectorId: OktaSSOv2
  dataTypes:
  - OktaSSO
triggerOperator: gt
version: 1.1.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/FailedLoginsFromUnknownOrInvalidUser.yaml
id: 884be6e7-e568-418e-9c12-89229865ffde
queryFrequency: 1h
query: |
  let FailureThreshold = 15;
  let FailedLogins = OktaSSO
  | where eventType_s =~ "user.session.start" and outcome_reason_s =~ "VERIFICATION_ERROR"
  | summarize count() by actor_alternateId_s, client_ipAddress_s, bin(TimeGenerated, 5m)
  | where count_ > FailureThreshold
  | project client_ipAddress_s, actor_alternateId_s;
  OktaSSO
  | join kind=inner (FailedLogins) on client_ipAddress_s, actor_alternateId_s
  | where eventType_s =~ "user.session.start" and outcome_reason_s =~ "VERIFICATION_ERROR"
  | summarize count() by actor_alternateId_s, ClientIP = client_ipAddress_s, City = column_ifexists('client_geographicalContext_city_s', ""), Country = column_ifexists('client_geographicalContext_country_s', ""), column_ifexists('published_t', now())
  | sort by column_ifexists('published_t', now()) desc  
severity: Medium
status: Available
queryPeriod: 1h
name: Failed Logins from Unknown or Invalid User
tactics:
- CredentialAccess
kind: Scheduled

ARM