Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Failed AWS Console logons but success logon to AzureAD

Back
Id910124df-913c-47e3-a7cd-29e1643fa55e
RulenameFailed AWS Console logons but success logon to AzureAD
DescriptionIdentifies a list of IP addresses with a minimum numbe(default of 5) of failed logon attempts to AWS Console.

Uses that list to identify any successful Azure Active Directory logons from these IPs within the same timeframe.
SeverityMedium
TacticsInitialAccess
CredentialAccess
TechniquesT1078
T1110
Required data connectorsAWS
AzureActiveDirectory
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/AWSConsoleAADCorrelation.yaml
Version1.0.3
Arm template910124df-913c-47e3-a7cd-29e1643fa55e.json
Deploy To Azure
//Adjust this threshold to fit environment
let  signin_threshold = 5;
//Make a list of IPs with failed AWS console logins
let aws_fails = AWSCloudTrail
| where EventName == "ConsoleLogin"
| extend LoginResult = tostring(parse_json(ResponseElements).ConsoleLogin)
| where LoginResult != "Success"
| where SourceIpAddress != "127.0.0.1"
| summarize count() by SourceIpAddress
| where count_ >  signin_threshold
| summarize make_set(SourceIpAddress);
//See if any of those IPs have sucessfully logged into Azure AD.
SigninLogs
| where ResultType in ("0", "50125", "50140")
| where IPAddress in (aws_fails)
| extend Reason = "Multiple failed AWS Console logins from IP address"
| extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress
requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - SigninLogs
- connectorId: AWS
  dataTypes:
  - AWSCloudTrail
triggerOperator: gt
queryFrequency: 1d
name: Failed AWS Console logons but success logon to AzureAD
queryPeriod: 1d
metadata:
  categories:
    domains:
    - Security - Others
    - Identity
  support:
    tier: Community
  author:
    name: Pete Bryan
  source:
    kind: Community
id: 910124df-913c-47e3-a7cd-29e1643fa55e
description: |
  'Identifies a list of IP addresses with a minimum numbe(default of 5) of failed logon attempts to AWS Console.
  Uses that list to identify any successful Azure Active Directory logons from these IPs within the same timeframe.'  
severity: Medium
query: |
  //Adjust this threshold to fit environment
  let  signin_threshold = 5;
  //Make a list of IPs with failed AWS console logins
  let aws_fails = AWSCloudTrail
  | where EventName == "ConsoleLogin"
  | extend LoginResult = tostring(parse_json(ResponseElements).ConsoleLogin)
  | where LoginResult != "Success"
  | where SourceIpAddress != "127.0.0.1"
  | summarize count() by SourceIpAddress
  | where count_ >  signin_threshold
  | summarize make_set(SourceIpAddress);
  //See if any of those IPs have sucessfully logged into Azure AD.
  SigninLogs
  | where ResultType in ("0", "50125", "50140")
  | where IPAddress in (aws_fails)
  | extend Reason = "Multiple failed AWS Console logins from IP address"
  | extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress  
version: 1.0.3
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/AWSConsoleAADCorrelation.yaml
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
relevantTechniques:
- T1078
- T1110
tactics:
- InitialAccess
- CredentialAccess
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/910124df-913c-47e3-a7cd-29e1643fa55e')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/910124df-913c-47e3-a7cd-29e1643fa55e')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Failed AWS Console logons but success logon to AzureAD",
        "description": "'Identifies a list of IP addresses with a minimum numbe(default of 5) of failed logon attempts to AWS Console.\nUses that list to identify any successful Azure Active Directory logons from these IPs within the same timeframe.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "//Adjust this threshold to fit environment\nlet  signin_threshold = 5;\n//Make a list of IPs with failed AWS console logins\nlet aws_fails = AWSCloudTrail\n| where EventName == \"ConsoleLogin\"\n| extend LoginResult = tostring(parse_json(ResponseElements).ConsoleLogin)\n| where LoginResult != \"Success\"\n| where SourceIpAddress != \"127.0.0.1\"\n| summarize count() by SourceIpAddress\n| where count_ >  signin_threshold\n| summarize make_set(SourceIpAddress);\n//See if any of those IPs have sucessfully logged into Azure AD.\nSigninLogs\n| where ResultType in (\"0\", \"50125\", \"50140\")\n| where IPAddress in (aws_fails)\n| extend Reason = \"Multiple failed AWS Console logins from IP address\"\n| extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "CredentialAccess"
        ],
        "techniques": [
          "T1078",
          "T1110"
        ],
        "alertRuleTemplateName": "910124df-913c-47e3-a7cd-29e1643fa55e",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "AccountCustomEntity"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "IPCustomEntity"
              }
            ],
            "entityType": "IP"
          }
        ],
        "templateVersion": "1.0.3",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/AWSConsoleAADCorrelation.yaml"
      }
    }
  ]
}