StealthTalk - Password brute force | Microsoft Sentinel Analytic Rules

Back


Id	b8e5f3a2-9c4d-4d1f-8a7b-3c2d1e0f9a8b
Rulename	StealthTalk - Password brute force
Description	Identifies a brute-force authentication attempt against a single StealthTalk user account. The StealthTalk anti-brute-force subsystem emits a `MultiFailLogin` event when consecutive failed attempts trigger an automatic account lockout. This rule fires when the reported number of consecutive failures is 9 or more, distinguishing a credential-guessing attack from an isolated user error. The lockout duration (`LoginBlockingSeconds`) is surfaced as a custom detail so the SOC analyst can prioritise by attack persistence.
Severity	High
Tactics	CredentialAccess InitialAccess
Techniques	T1110
Required data connectors	StealthTalkAnomalousAuth
Kind	Scheduled
Query frequency	15m
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/PasswordBruteForce.yaml
Version	1.0.0
Arm template	b8e5f3a2-9c4d-4d1f-8a7b-3c2d1e0f9a8b.json

KQL

let LookbackPeriod    = 5h;
let MinFailedAttempts = 9;
StealthTalkAnomalousAuth_CL
| where TimeGenerated >= ago(LookbackPeriod)
| where EventType == "MultiFailLogin"
| where PassedAttempts >= MinFailedAttempts
| extend
    BlockingMinutes = LoginBlockingSeconds / 60,
    AlertName       = "PasswordBruteForce",
    AlertDetails    = strcat(
        "User ", UserId,
        " had ", PassedAttempts, " consecutive failed login attempts",
        " on device ", DeviceId, ".",
        " Account blocked for ", LoginBlockingSeconds, " seconds",
        " (", LoginBlockingSeconds / 60, " min)."
    )
| project
    TimeGenerated, UserId, DeviceId,
    PassedAttempts, LoginBlockingSeconds, BlockingMinutes,
    AppVersion, RawEventId, AlertName, AlertDetails

YAML

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByEntities:
    - Account
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
    lookbackDuration: 5h
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserId
    identifier: Name
- entityType: Host
  fieldMappings:
  - columnName: DeviceId
    identifier: HostName
query: |
  let LookbackPeriod    = 5h;
  let MinFailedAttempts = 9;
  StealthTalkAnomalousAuth_CL
  | where TimeGenerated >= ago(LookbackPeriod)
  | where EventType == "MultiFailLogin"
  | where PassedAttempts >= MinFailedAttempts
  | extend
      BlockingMinutes = LoginBlockingSeconds / 60,
      AlertName       = "PasswordBruteForce",
      AlertDetails    = strcat(
          "User ", UserId,
          " had ", PassedAttempts, " consecutive failed login attempts",
          " on device ", DeviceId, ".",
          " Account blocked for ", LoginBlockingSeconds, " seconds",
          " (", LoginBlockingSeconds / 60, " min)."
      )
  | project
      TimeGenerated, UserId, DeviceId,
      PassedAttempts, LoginBlockingSeconds, BlockingMinutes,
      AppVersion, RawEventId, AlertName, AlertDetails
suppressionEnabled: false
id: b8e5f3a2-9c4d-4d1f-8a7b-3c2d1e0f9a8b
queryFrequency: 15m
alertDetailsOverride:
  alertDisplayNameFormat: 'StealthTalk: Password Brute Force - {{UserId}} ({{PassedAttempts}} failed attempts)'
  alertDescriptionFormat: '{{AlertDetails}}'
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/PasswordBruteForce.yaml
suppressionDuration: 5h
version: 1.0.0
severity: High
relevantTechniques:
- T1110
name: StealthTalk - Password brute force
kind: Scheduled
tactics:
- CredentialAccess
- InitialAccess
requiredDataConnectors:
- dataTypes:
  - StealthTalkAnomalousAuth_CL
  connectorId: StealthTalkAnomalousAuth
description: |
  Identifies a brute-force authentication attempt against a single StealthTalk user account. The StealthTalk anti-brute-force subsystem emits a `MultiFailLogin` event when consecutive failed attempts trigger an automatic account lockout. This rule fires when the reported number of consecutive failures is 9 or more, distinguishing a credential-guessing attack from an isolated user error. The lockout duration (`LoginBlockingSeconds`) is surfaced as a custom detail so the SOC analyst can prioritise by attack persistence.
customDetails:
  AppVersion: AppVersion
  PassedAttempts: PassedAttempts
  BlockingMinutes: BlockingMinutes
  LoginBlockingSeconds: LoginBlockingSeconds
  EventReference: RawEventId
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 5h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b8e5f3a2-9c4d-4d1f-8a7b-3c2d1e0f9a8b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b8e5f3a2-9c4d-4d1f-8a7b-3c2d1e0f9a8b')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{AlertDetails}}",
          "alertDisplayNameFormat": "StealthTalk: Password Brute Force - {{UserId}} ({{PassedAttempts}} failed attempts)"
        },
        "alertRuleTemplateName": "b8e5f3a2-9c4d-4d1f-8a7b-3c2d1e0f9a8b",
        "customDetails": {
          "AppVersion": "AppVersion",
          "BlockingMinutes": "BlockingMinutes",
          "EventReference": "RawEventId",
          "LoginBlockingSeconds": "LoginBlockingSeconds",
          "PassedAttempts": "PassedAttempts"
        },
        "description": "Identifies a brute-force authentication attempt against a single StealthTalk user account. The StealthTalk anti-brute-force subsystem emits a `MultiFailLogin` event when consecutive failed attempts trigger an automatic account lockout. This rule fires when the reported number of consecutive failures is 9 or more, distinguishing a credential-guessing attack from an isolated user error. The lockout duration (`LoginBlockingSeconds`) is surfaced as a custom detail so the SOC analyst can prioritise by attack persistence.\n",
        "displayName": "StealthTalk - Password brute force",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserId",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceId",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT5H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/PasswordBruteForce.yaml",
        "query": "let LookbackPeriod    = 5h;\nlet MinFailedAttempts = 9;\nStealthTalkAnomalousAuth_CL\n| where TimeGenerated >= ago(LookbackPeriod)\n| where EventType == \"MultiFailLogin\"\n| where PassedAttempts >= MinFailedAttempts\n| extend\n    BlockingMinutes = LoginBlockingSeconds / 60,\n    AlertName       = \"PasswordBruteForce\",\n    AlertDetails    = strcat(\n        \"User \", UserId,\n        \" had \", PassedAttempts, \" consecutive failed login attempts\",\n        \" on device \", DeviceId, \".\",\n        \" Account blocked for \", LoginBlockingSeconds, \" seconds\",\n        \" (\", LoginBlockingSeconds / 60, \" min).\"\n    )\n| project\n    TimeGenerated, UserId, DeviceId,\n    PassedAttempts, LoginBlockingSeconds, BlockingMinutes,\n    AppVersion, RawEventId, AlertName, AlertDetails\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT5H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1110"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}