HoneyLabs TI Map IP Entity to SigninLogs | Microsoft Sentinel Analytic Rules

Back


Id	a573396f-06ed-4139-bccc-e0f88a2cf625
Rulename	HoneyLabs TI Map IP Entity to SigninLogs
Description	Identifies sign-ins (interactive and non-interactive) from IP addresses that HoneyLabs honeypot telemetry has observed running exploit or loader commands. A hit means credential access is being attempted from infrastructure with recent, evidenced malicious activity. Indicator Confidence reflects how much evidence HoneyLabs holds (90 = 100+ observed attacks, 60 = a single sighting); raise the threshold in the query to trade coverage for precision.
Severity	Medium
Tactics	InitialAccess CredentialAccess
Techniques	T1190 T1110
Required data connectors	AzureActiveDirectory ThreatIntelligenceTaxii
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/HoneyLabs/Analytic%20Rules/HoneyLabsTIMapIPEntitySigninLogs.yaml
Version	1.0.0
Arm template	a573396f-06ed-4139-bccc-e0f88a2cf625.json

KQL

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
let HoneyLabs_IPs = ThreatIntelIndicators
  | where TimeGenerated >= ago(ioc_lookBack)
  | where IsActive == true and ValidUntil > now()
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
  | where SourceSystem startswith 'HoneyLabs'
  | where ObservableKey == 'ipv4-addr:value'
  | extend TI_ipEntity = tostring(ObservableValue),
           HoneyLabsConfidence = Confidence,
           HoneyLabsLabels = tostring(Data.labels),
           IndicatorDescription = tostring(Data.description),
           HoneyLabsReport = strcat('https://honeylabs.net/lookup/', tostring(ObservableValue));
let aadSignin = SigninLogs | where TimeGenerated >= ago(dt_lookBack)
  | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;
let aadNonInt = AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(dt_lookBack)
  | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;
HoneyLabs_IPs
| join kind=innerunique (union isfuzzy=true aadSignin, aadNonInt
    | extend CS_ipEntity = IPAddress
    | extend Signin_TimeGenerated = TimeGenerated
) on $left.TI_ipEntity == $right.CS_ipEntity
| where Signin_TimeGenerated < ValidUntil
| summarize Signin_TimeGenerated = arg_max(Signin_TimeGenerated, *) by Id, CS_ipEntity
| project Signin_TimeGenerated, IndicatorDescription, Id, ValidUntil, HoneyLabsConfidence,
  HoneyLabsLabels, HoneyLabsReport, TI_ipEntity, CS_ipEntity, UserPrincipalName, ResultType,
  AppDisplayName, Location
| extend timestamp = Signin_TimeGenerated

YAML

queryFrequency: 1h
kind: Scheduled
name: HoneyLabs TI Map IP Entity to SigninLogs
tactics:
- InitialAccess
- CredentialAccess
relevantTechniques:
- T1190
- T1110
version: 1.0.0
description: |
  'Identifies sign-ins (interactive and non-interactive) from IP addresses that HoneyLabs honeypot telemetry has observed running exploit or loader commands. A hit means credential access is being attempted from infrastructure with recent, evidenced malicious activity. Indicator Confidence reflects how much evidence HoneyLabs holds (90 = 100+ observed attacks, 60 = a single sighting); raise the threshold in the query to trade coverage for precision.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/HoneyLabs/Analytic%20Rules/HoneyLabsTIMapIPEntitySigninLogs.yaml
id: a573396f-06ed-4139-bccc-e0f88a2cf625
requiredDataConnectors:
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: ThreatIntelligenceTaxii
- dataTypes:
  - SigninLogs
  connectorId: AzureActiveDirectory
- dataTypes:
  - AADNonInteractiveUserSignInLogs
  connectorId: AzureActiveDirectory
severity: Medium
triggerOperator: gt
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: CS_ipEntity
    identifier: Address
- entityType: Account
  fieldMappings:
  - columnName: UserPrincipalName
    identifier: FullName
queryPeriod: 14d
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let HoneyLabs_IPs = ThreatIntelIndicators
    | where TimeGenerated >= ago(ioc_lookBack)
    | where IsActive == true and ValidUntil > now()
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
    | where SourceSystem startswith 'HoneyLabs'
    | where ObservableKey == 'ipv4-addr:value'
    | extend TI_ipEntity = tostring(ObservableValue),
             HoneyLabsConfidence = Confidence,
             HoneyLabsLabels = tostring(Data.labels),
             IndicatorDescription = tostring(Data.description),
             HoneyLabsReport = strcat('https://honeylabs.net/lookup/', tostring(ObservableValue));
  let aadSignin = SigninLogs | where TimeGenerated >= ago(dt_lookBack)
    | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;
  let aadNonInt = AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(dt_lookBack)
    | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;
  HoneyLabs_IPs
  | join kind=innerunique (union isfuzzy=true aadSignin, aadNonInt
      | extend CS_ipEntity = IPAddress
      | extend Signin_TimeGenerated = TimeGenerated
  ) on $left.TI_ipEntity == $right.CS_ipEntity
  | where Signin_TimeGenerated < ValidUntil
  | summarize Signin_TimeGenerated = arg_max(Signin_TimeGenerated, *) by Id, CS_ipEntity
  | project Signin_TimeGenerated, IndicatorDescription, Id, ValidUntil, HoneyLabsConfidence,
    HoneyLabsLabels, HoneyLabsReport, TI_ipEntity, CS_ipEntity, UserPrincipalName, ResultType,
    AppDisplayName, Location
  | extend timestamp = Signin_TimeGenerated
triggerThreshold: 0

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a573396f-06ed-4139-bccc-e0f88a2cf625')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a573396f-06ed-4139-bccc-e0f88a2cf625')]",
      "properties": {
        "alertRuleTemplateName": "a573396f-06ed-4139-bccc-e0f88a2cf625",
        "customDetails": null,
        "description": "'Identifies sign-ins (interactive and non-interactive) from IP addresses that HoneyLabs honeypot telemetry has observed running exploit or loader commands. A hit means credential access is being attempted from infrastructure with recent, evidenced malicious activity. Indicator Confidence reflects how much evidence HoneyLabs holds (90 = 100+ observed attacks, 60 = a single sighting); raise the threshold in the query to trade coverage for precision.'\n",
        "displayName": "HoneyLabs TI Map IP Entity to SigninLogs",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "CS_ipEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserPrincipalName",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/HoneyLabs/Analytic%20Rules/HoneyLabsTIMapIPEntitySigninLogs.yaml",
        "query": "let dt_lookBack = 1h;\nlet ioc_lookBack = 14d;\nlet HoneyLabs_IPs = ThreatIntelIndicators\n  | where TimeGenerated >= ago(ioc_lookBack)\n  | where IsActive == true and ValidUntil > now()\n  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id\n  | where SourceSystem startswith 'HoneyLabs'\n  | where ObservableKey == 'ipv4-addr:value'\n  | extend TI_ipEntity = tostring(ObservableValue),\n           HoneyLabsConfidence = Confidence,\n           HoneyLabsLabels = tostring(Data.labels),\n           IndicatorDescription = tostring(Data.description),\n           HoneyLabsReport = strcat('https://honeylabs.net/lookup/', tostring(ObservableValue));\nlet aadSignin = SigninLogs | where TimeGenerated >= ago(dt_lookBack)\n  | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;\nlet aadNonInt = AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(dt_lookBack)\n  | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;\nHoneyLabs_IPs\n| join kind=innerunique (union isfuzzy=true aadSignin, aadNonInt\n    | extend CS_ipEntity = IPAddress\n    | extend Signin_TimeGenerated = TimeGenerated\n) on $left.TI_ipEntity == $right.CS_ipEntity\n| where Signin_TimeGenerated < ValidUntil\n| summarize Signin_TimeGenerated = arg_max(Signin_TimeGenerated, *) by Id, CS_ipEntity\n| project Signin_TimeGenerated, IndicatorDescription, Id, ValidUntil, HoneyLabsConfidence,\n  HoneyLabsLabels, HoneyLabsReport, TI_ipEntity, CS_ipEntity, UserPrincipalName, ResultType,\n  AppDisplayName, Location\n| extend timestamp = Signin_TimeGenerated\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1110",
          "T1190"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}