Failed Logins from Unknown or Invalid User

Back


Id	884be6e7-e568-418e-9c12-89229865ffde
Rulename	Failed Logins from Unknown or Invalid User
Description	This query searches for numerous login attempts to the management console with an unknown or invalid user name.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	OktaSSO OktaSSOv2
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/FailedLoginsFromUnknownOrInvalidUser.yaml
Version	1.1.1
Arm template	884be6e7-e568-418e-9c12-89229865ffde.json

KQL

let FailureThreshold = 15;
let FailedLogins = OktaSSO
| where eventType_s =~ "user.session.start" and outcome_reason_s =~ "VERIFICATION_ERROR"
| summarize count() by actor_alternateId_s, client_ipAddress_s, bin(TimeGenerated, 5m)
| where count_ > FailureThreshold
| project client_ipAddress_s, actor_alternateId_s;
OktaSSO
| join kind=inner (FailedLogins) on client_ipAddress_s, actor_alternateId_s
| where eventType_s =~ "user.session.start" and outcome_reason_s =~ "VERIFICATION_ERROR"
| summarize count() by actor_alternateId_s, ClientIP = client_ipAddress_s, City = column_ifexists('client_geographicalContext_city_s', ""), Country = column_ifexists('client_geographicalContext_country_s', ""), column_ifexists('published_t', now())
| sort by column_ifexists('published_t', now()) desc

YAML

description: |
    'This query searches for numerous login attempts to the management console with an unknown or invalid user name.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Okta Single Sign-On/Analytic Rules/FailedLoginsFromUnknownOrInvalidUser.yaml
requiredDataConnectors:
- dataTypes:
  - Okta_CL
  connectorId: OktaSSO
- dataTypes:
  - OktaSSO
  connectorId: OktaSSOv2
query: |
  let FailureThreshold = 15;
  let FailedLogins = OktaSSO
  | where eventType_s =~ "user.session.start" and outcome_reason_s =~ "VERIFICATION_ERROR"
  | summarize count() by actor_alternateId_s, client_ipAddress_s, bin(TimeGenerated, 5m)
  | where count_ > FailureThreshold
  | project client_ipAddress_s, actor_alternateId_s;
  OktaSSO
  | join kind=inner (FailedLogins) on client_ipAddress_s, actor_alternateId_s
  | where eventType_s =~ "user.session.start" and outcome_reason_s =~ "VERIFICATION_ERROR"
  | summarize count() by actor_alternateId_s, ClientIP = client_ipAddress_s, City = column_ifexists('client_geographicalContext_city_s', ""), Country = column_ifexists('client_geographicalContext_country_s', ""), column_ifexists('published_t', now())
  | sort by column_ifexists('published_t', now()) desc  
triggerThreshold: 0
name: Failed Logins from Unknown or Invalid User
relevantTechniques:
- T1110
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: actor_alternateId_s
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: ClientIP
    identifier: Address
tactics:
- CredentialAccess
queryPeriod: 1h
severity: Medium
status: Available
queryFrequency: 1h
id: 884be6e7-e568-418e-9c12-89229865ffde
kind: Scheduled
version: 1.1.1
triggerOperator: gt

ARM