Utimaco ESKM - PERMISSION_DENIED burst for a KMIP user

Back


Id	9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a02
Rulename	Utimaco ESKM - PERMISSION_DENIED burst for a KMIP user
Description	Identifies a single KMIP user receiving 10 or more PERMISSION_DENIED responses within 30 minutes on Utimaco ESKM. May indicate privilege probing, key access reconnaissance, or a misconfigured application.
Severity	Medium
Tactics	Discovery
Techniques	T1087
Required data connectors	UtimacoESKMConnector
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Utimaco Enterprise Secure Key Manager/Analytic Rules/UtimacoESKM_PermissionDeniedBurst.yaml
Version	1.0.0
Arm template	9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a02.json

KQL

UtimacoESKMKmipServerLogs_CL
| where TimeGenerated > ago(30m)
| where Reason == "PERMISSION_DENIED"
| where isnotempty(User)
| summarize DeniedCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_set(Operation, 50), ObjectTypes = make_set(ObjectType, 25), SourceIPs = make_set(IP, 25) by User
| where DeniedCount >= 10
| extend AccountCustomEntity = User

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
tactics:
- Discovery
requiredDataConnectors:
- dataTypes:
  - UtimacoESKMKmipServerLogs_CL
  connectorId: UtimacoESKMConnector
id: 9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a02
severity: Medium
status: Available
query: |
  UtimacoESKMKmipServerLogs_CL
  | where TimeGenerated > ago(30m)
  | where Reason == "PERMISSION_DENIED"
  | where isnotempty(User)
  | summarize DeniedCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_set(Operation, 50), ObjectTypes = make_set(ObjectType, 25), SourceIPs = make_set(IP, 25) by User
  | where DeniedCount >= 10
  | extend AccountCustomEntity = User  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Utimaco Enterprise Secure Key Manager/Analytic Rules/UtimacoESKM_PermissionDeniedBurst.yaml
kind: Scheduled
queryPeriod: 30m
version: 1.0.0
name: Utimaco ESKM - PERMISSION_DENIED burst for a KMIP user
queryFrequency: 30m
triggerThreshold: 0
relevantTechniques:
- T1087
description: |
    Identifies a single KMIP user receiving 10 or more PERMISSION_DENIED responses within 30 minutes on Utimaco ESKM. May indicate privilege probing, key access reconnaissance, or a misconfigured application.
triggerOperator: gt

ARM