Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Azure secure score PW age policy new

Back
Id88C9A5E0-31EC-490B-82E5-A286D9B99A67
RulenameAzure secure score PW age policy new
DescriptionThis query searches for having found that when periodic password resets are enforced,

passwords become less secure. Users tend to pick a weaker password and vary it slightly for each reset.

If a user creates a strong password (long, complex and without any pragmatic words present)

it should remain just as strong in the future as it is today. It is Microsoft’s official security position

to not expire passwords periodically without a specific reason, and recommends

that cloud-only tenants set the password policy to never expire.
SeverityMedium
TacticsCredentialAccess
TechniquesT1555
T1606
T1040
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/PasswordAgePolicyNew.yaml
Version1.0.0
Arm template88C9A5E0-31EC-490B-82E5-A286D9B99A67.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'AzureSecureScorePWAgePolicyNew'
queryFrequency: 6h
triggerThreshold: 0
name: Azure secure score PW age policy new
version: 1.0.0
id: 88C9A5E0-31EC-490B-82E5-A286D9B99A67
status: Available
tactics:
- CredentialAccess
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
- entityType: SecurityGroup
  fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
- entityType: AzureResource
  fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
queryPeriod: 6h
description: |
  'This query searches for having found that when periodic password resets are enforced,
   passwords become less secure. Users tend to pick a weaker password and vary it slightly for each reset. 
   If a user creates a strong password (long, complex and without any pragmatic words present)
   it should remain just as strong in the future as it is today. It is Microsoft's official security position
   to not expire passwords periodically without a specific reason, and recommends 
   that cloud-only tenants set the password policy to never expire.'  
requiredDataConnectors:
- connectorId: SenservaPro
  dataTypes:
  - SenservaPro_CL
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScorePWAgePolicyNew'  
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/PasswordAgePolicyNew.yaml
triggerOperator: gt
relevantTechniques:
- T1555
- T1606
- T1040
severity: Medium
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/88C9A5E0-31EC-490B-82E5-A286D9B99A67')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/88C9A5E0-31EC-490B-82E5-A286D9B99A67')]",
      "properties": {
        "alertRuleTemplateName": "88C9A5E0-31EC-490B-82E5-A286D9B99A67",
        "customDetails": null,
        "description": "'This query searches for having found that when periodic password resets are enforced,\n passwords become less secure. Users tend to pick a weaker password and vary it slightly for each reset. \n If a user creates a strong password (long, complex and without any pragmatic words present)\n it should remain just as strong in the future as it is today. It is Microsoft's official security position\n to not expire passwords periodically without a specific reason, and recommends \n that cloud-only tenants set the password policy to never expire.'\n",
        "displayName": "Azure secure score PW age policy new",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/PasswordAgePolicyNew.yaml",
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScorePWAgePolicyNew'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1040",
          "T1555",
          "T1606"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}