Excessive number of HTTP authentication failures from a source ASIM Web Session schema

Back


Id	a1bddaf8-982b-4089-ba9e-6590dfcf80ea
Rulename	Excessive number of HTTP authentication failures from a source (ASIM Web Session schema)
Description	This rule identifies a source that repeatedly fails to authenticate to a web service (HTTP response code 403). This may indicate a brute force or credential stuffing attack. This rule uses the Advanced Security Information Model (ASIM) and supports any web session source that complies with ASIM.
Severity	Low
Tactics	Persistence CredentialAccess
Techniques	T1110 T1556
Required data connectors	SquidProxy Zscaler
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimWebSession/ExcessiveNetworkFailuresFromSource.yaml
Version	1.0.5
Arm template	a1bddaf8-982b-4089-ba9e-6590dfcf80ea.json

KQL

let error403_count_threshold=200;
_Im_WebSession(eventresultdetails_in=dynamic(["403"]))
| extend ParsedUrl=parse_url(Url)
| extend UrlHost=tostring(ParsedUrl["Host"]), UrlSchema=tostring(ParsedUrl["Schema"])
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), NumberOfErrors = count(), Urls=makeset(Url) by UrlHost, SrcIpAddr
| where NumberOfErrors > error403_count_threshold
| sort by NumberOfErrors desc
| extend Url=tostring(Urls[0])

YAML

relevantTechniques:
- T1110
- T1556
entityMappings:
- fieldMappings:
  - columnName: Url
    identifier: Url
  entityType: URL
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
version: 1.0.5
triggerThreshold: 0
description: |
  This rule identifies a source that repeatedly fails to authenticate to a web service (HTTP response code 403). This may indicate a [brute force](https://en.wikipedia.org/wiki/Brute-force_attack) or [credential stuffing](https://en.wikipedia.org/wiki/Credential_stuffing) attack.
  This rule uses the [Advanced Security Information Model (ASIM)](https://aka.ms/AboutSIM) and supports any web session source that complies with ASIM.  
metadata:
  author:
    name: Yaron
  source:
    kind: Community
  categories:
    domains:
    - Security - Others
  support:
    tier: Community
customDetails:
  NumberOfErrors: NumberOfErrors
requiredDataConnectors:
- connectorId: SquidProxy
  dataTypes:
  - SquidProxy_CL
- connectorId: Zscaler
  dataTypes:
  - CommonSecurityLog
triggerOperator: gt
alertDetailsOverride:
  alertDisplayNameFormat: Excessive number of HTTP authentication failures from {{SrcIpAddr}
  alertDescriptionFormat: A client with address {{SrcIpAddr}} generated a large number of failed authentication HTTP requests. This may indicate a [brute force](https://en.wikipedia.org/wiki/Brute-force_attack) or [credential stuffing](https://en.wikipedia.org/wiki/Credential_stuffing) attack.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimWebSession/ExcessiveNetworkFailuresFromSource.yaml
id: a1bddaf8-982b-4089-ba9e-6590dfcf80ea
queryFrequency: 1d
query: |
  let error403_count_threshold=200;
  _Im_WebSession(eventresultdetails_in=dynamic(["403"]))
  | extend ParsedUrl=parse_url(Url)
  | extend UrlHost=tostring(ParsedUrl["Host"]), UrlSchema=tostring(ParsedUrl["Schema"])
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), NumberOfErrors = count(), Urls=makeset(Url) by UrlHost, SrcIpAddr
  | where NumberOfErrors > error403_count_threshold
  | sort by NumberOfErrors desc
  | extend Url=tostring(Urls[0])  
severity: Low
kind: Scheduled
queryPeriod: 1d
name: Excessive number of HTTP authentication failures from a source (ASIM Web Session schema)
tactics:
- Persistence
- CredentialAccess
tags:
- ParentAlert: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/Wazuh-Large%20Number%20of%20Web%20errors%20from%20an%20IP.yaml
  ParentVersion: 1.1.0
- Schema: ASIMWebSession
  SchemaVersion: 0.2.1

ARM