StealthTalk - Login outside work zone | Microsoft Sentinel Analytic Rules

Back


Id	a7c3e9b1-4f5d-4e2a-9b8c-1d2e3f4a5b6c
Rulename	StealthTalk - Login outside work zone
Description	Identifies a single StealthTalk authentication originating from a country or city that does not match the user’s assigned (expected) geographic zone. Each individual mismatch is treated as an incident - there is no aggregation threshold, since a single login from an unexpected country is high-confidence evidence of a credential issue. An incident fires when LoginCountry differs from AssignedCountry OR LoginCity differs from AssignedCity. Source IPv4, raw event ID, and both the observed and expected geo-locations are surfaced as entities and custom details for the SOC analyst.
Severity	High
Tactics	InitialAccess DefenseEvasion CredentialAccess
Techniques	T1078
Required data connectors	StealthTalkAnomalousAuth
Kind	Scheduled
Query frequency	15m
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/LoginOutsideWorkZone.yaml
Version	1.0.0
Arm template	a7c3e9b1-4f5d-4e2a-9b8c-1d2e3f4a5b6c.json

KQL

let LookbackPeriod = 1h;
StealthTalkAnomalousAuth_CL
| where TimeGenerated >= ago(LookbackPeriod)
| where EventType == "GeoAnomalyLogin"
| where LoginCountry != AssignedCountry
     or LoginCity    != AssignedCity
| extend
    CountryMismatch = LoginCountry != AssignedCountry,
    CityMismatch    = LoginCity    != AssignedCity,
    AlertName       = "LoginOutsideWorkZone",
    AlertDetails    = strcat(
        "User ", UserId,
        " logged in from ", LoginCity, " (", LoginCountry, ")",
        " - assigned zone: ", AssignedCity, " (", AssignedCountry, ").",
        " Source IP: ", IpAddress, ".",
        " Country mismatch: ", tostring(LoginCountry != AssignedCountry), ".",
        " City mismatch: ", tostring(LoginCity != AssignedCity), "."
    )
| project
    TimeGenerated, UserId, DeviceId,
    LoginCountry, LoginCity, AssignedCountry, AssignedCity,
    CountryMismatch, CityMismatch, IpAddress,
    AppVersion, RawEventId, AlertName, AlertDetails

YAML

incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 5h
    reopenClosedIncident: false
    groupByEntities:
    - Account
    matchingMethod: Selected
    enabled: true
  createIncident: true
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/LoginOutsideWorkZone.yaml
triggerThreshold: 0
id: a7c3e9b1-4f5d-4e2a-9b8c-1d2e3f4a5b6c
suppressionEnabled: false
kind: Scheduled
relevantTechniques:
- T1078
version: 1.0.0
tactics:
- InitialAccess
- DefenseEvasion
- CredentialAccess
queryPeriod: 1h
queryFrequency: 15m
alertDetailsOverride:
  alertDescriptionFormat: '{{AlertDetails}}'
  alertDisplayNameFormat: 'StealthTalk: Login Outside Work Zone - {{UserId}} from {{LoginCity}} ({{LoginCountry}})'
severity: High
name: StealthTalk - Login outside work zone
customDetails:
  LoginCountry: LoginCountry
  LoginCity: LoginCity
  AppVersion: AppVersion
  EventReference: RawEventId
  AssignedCountry: AssignedCountry
  CountryMismatch: CountryMismatch
  AssignedCity: AssignedCity
  CityMismatch: CityMismatch
requiredDataConnectors:
- connectorId: StealthTalkAnomalousAuth
  dataTypes:
  - StealthTalkAnomalousAuth_CL
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: UserId
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DeviceId
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IpAddress
description: |
  Identifies a single StealthTalk authentication originating from a country or city that does
  not match the user's assigned (expected) geographic zone. Each individual mismatch is
  treated as an incident - there is no aggregation threshold, since a single login from an
  unexpected country is high-confidence evidence of a credential issue.

  An incident fires when LoginCountry differs from AssignedCountry OR LoginCity differs
  from AssignedCity. Source IPv4, raw event ID, and both the observed and expected
  geo-locations are surfaced as entities and custom details for the SOC analyst.
status: Available
query: |
  let LookbackPeriod = 1h;
  StealthTalkAnomalousAuth_CL
  | where TimeGenerated >= ago(LookbackPeriod)
  | where EventType == "GeoAnomalyLogin"
  | where LoginCountry != AssignedCountry
       or LoginCity    != AssignedCity
  | extend
      CountryMismatch = LoginCountry != AssignedCountry,
      CityMismatch    = LoginCity    != AssignedCity,
      AlertName       = "LoginOutsideWorkZone",
      AlertDetails    = strcat(
          "User ", UserId,
          " logged in from ", LoginCity, " (", LoginCountry, ")",
          " - assigned zone: ", AssignedCity, " (", AssignedCountry, ").",
          " Source IP: ", IpAddress, ".",
          " Country mismatch: ", tostring(LoginCountry != AssignedCountry), ".",
          " City mismatch: ", tostring(LoginCity != AssignedCity), "."
      )
  | project
      TimeGenerated, UserId, DeviceId,
      LoginCountry, LoginCity, AssignedCountry, AssignedCity,
      CountryMismatch, CityMismatch, IpAddress,
      AppVersion, RawEventId, AlertName, AlertDetails
suppressionDuration: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a7c3e9b1-4f5d-4e2a-9b8c-1d2e3f4a5b6c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a7c3e9b1-4f5d-4e2a-9b8c-1d2e3f4a5b6c')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{AlertDetails}}",
          "alertDisplayNameFormat": "StealthTalk: Login Outside Work Zone - {{UserId}} from {{LoginCity}} ({{LoginCountry}})"
        },
        "alertRuleTemplateName": "a7c3e9b1-4f5d-4e2a-9b8c-1d2e3f4a5b6c",
        "customDetails": {
          "AppVersion": "AppVersion",
          "AssignedCity": "AssignedCity",
          "AssignedCountry": "AssignedCountry",
          "CityMismatch": "CityMismatch",
          "CountryMismatch": "CountryMismatch",
          "EventReference": "RawEventId",
          "LoginCity": "LoginCity",
          "LoginCountry": "LoginCountry"
        },
        "description": "Identifies a single StealthTalk authentication originating from a country or city that does\nnot match the user's assigned (expected) geographic zone. Each individual mismatch is\ntreated as an incident - there is no aggregation threshold, since a single login from an\nunexpected country is high-confidence evidence of a credential issue.\n\nAn incident fires when LoginCountry differs from AssignedCountry OR LoginCity differs\nfrom AssignedCity. Source IPv4, raw event ID, and both the observed and expected\ngeo-locations are surfaced as entities and custom details for the SOC analyst.\n",
        "displayName": "StealthTalk - Login outside work zone",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserId",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceId",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IpAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT5H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/LoginOutsideWorkZone.yaml",
        "query": "let LookbackPeriod = 1h;\nStealthTalkAnomalousAuth_CL\n| where TimeGenerated >= ago(LookbackPeriod)\n| where EventType == \"GeoAnomalyLogin\"\n| where LoginCountry != AssignedCountry\n     or LoginCity    != AssignedCity\n| extend\n    CountryMismatch = LoginCountry != AssignedCountry,\n    CityMismatch    = LoginCity    != AssignedCity,\n    AlertName       = \"LoginOutsideWorkZone\",\n    AlertDetails    = strcat(\n        \"User \", UserId,\n        \" logged in from \", LoginCity, \" (\", LoginCountry, \")\",\n        \" - assigned zone: \", AssignedCity, \" (\", AssignedCountry, \").\",\n        \" Source IP: \", IpAddress, \".\",\n        \" Country mismatch: \", tostring(LoginCountry != AssignedCountry), \".\",\n        \" City mismatch: \", tostring(LoginCity != AssignedCity), \".\"\n    )\n| project\n    TimeGenerated, UserId, DeviceId,\n    LoginCountry, LoginCity, AssignedCountry, AssignedCity,\n    CountryMismatch, CityMismatch, IpAddress,\n    AppVersion, RawEventId, AlertName, AlertDetails\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion",
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}