Versasec CMS - Multiple Failed Login Attempts

Back


Id	B1DB8B7E-9D74-48C3-9683-74483CBEFF4E
Rulename	Versasec CMS - Multiple Failed Login Attempts
Description	Detects when Operator login failed to often.
Severity	High
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	VersasecCms
Kind	Scheduled
Query frequency	5m
Query period	1h
Trigger threshold	5
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VersasecCMS/Analytic Rules/VersasecCmsOperatorLoginFailed.yaml
Version	1.0.1
Arm template	B1DB8B7E-9D74-48C3-9683-74483CBEFF4E.json

KQL

let threshold = 5;
VersasecCmsSysLogs 
| where EventId == 2 
| sort by ComputerName asc, TimeGenerated asc
| extend TimeDiff = datetime_diff('minute', TimeGenerated, prev(TimeGenerated))
| where TimeDiff <= threshold and ComputerName == prev(ComputerName)

YAML

name: Versasec CMS - Multiple Failed Login Attempts
relevantTechniques:
- T1110
id: B1DB8B7E-9D74-48C3-9683-74483CBEFF4E
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VersasecCMS/Analytic Rules/VersasecCmsOperatorLoginFailed.yaml
requiredDataConnectors:
- dataTypes:
  - VersasecCmsSysLogs
  connectorId: VersasecCms
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.1
severity: High
triggerThreshold: 5
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ComputerName
  entityType: Host
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: 5m
    enabled: false
  createIncident: true
queryFrequency: 5m
status: Available
query: |
  let threshold = 5;
  VersasecCmsSysLogs 
  | where EventId == 2 
  | sort by ComputerName asc, TimeGenerated asc
  | extend TimeDiff = datetime_diff('minute', TimeGenerated, prev(TimeGenerated))
  | where TimeDiff <= threshold and ComputerName == prev(ComputerName)  
tactics:
- CredentialAccess
kind: Scheduled
description: |
    Detects when Operator login failed to often.
triggerOperator: gt

ARM