Red Sift - Login from previously unseen IP address | Microsoft Sentinel Analytic Rules

Back


Id	c3d4e5f6-a7b8-9012-cdef-123456789012
Rulename	Red Sift - Login from previously unseen IP address
Description	Detects a successful login from an IP address that has not been seen in the previous 14 days for that user, which may indicate compromised credentials or unauthorized access.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	RedSiftPush
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Sift/Analytic%20Rules/RedSiftLoginFromNewIP.yaml
Version	1.0.1
Arm template	c3d4e5f6-a7b8-9012-cdef-123456789012.json

KQL

let lookback = 14d;
let recentWindow = 1h;
let historicalLogins = RedSiftAuth_CL
| extend
    ActivityName = tostring(column_ifexists("ActivityName", "")),
    UserEmail = tostring(column_ifexists("UserEmail", "")),
    SrcIp = tostring(column_ifexists("SrcIp", ""))
| where TimeGenerated between (ago(lookback) .. ago(recentWindow))
| where ActivityName has "Logon"
| where isnotempty(UserEmail) and isnotempty(SrcIp)
| summarize by UserEmail, SrcIp;
RedSiftAuth_CL
| extend
    ActivityName = tostring(column_ifexists("ActivityName", "")),
    UserEmail = tostring(column_ifexists("UserEmail", "")),
    SrcIp = tostring(column_ifexists("SrcIp", "")),
    HttpUserAgent = tostring(column_ifexists("HttpUserAgent", "")),
    ServiceName = tostring(column_ifexists("ServiceName", "")),
    Severity = tostring(column_ifexists("Severity", ""))
| where TimeGenerated >= ago(recentWindow)
| where ActivityName has "Logon"
| where isnotempty(UserEmail) and isnotempty(SrcIp)
| join kind=leftanti (historicalLogins) on UserEmail, SrcIp
| project
    TimeGenerated,
    UserEmail,
    SrcIp,
    HttpUserAgent,
    ServiceName,
    ActivityName,
    Severity

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: UserEmail
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIp
name: Red Sift - Login from previously unseen IP address
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Sift/Analytic%20Rules/RedSiftLoginFromNewIP.yaml
triggerOperator: gt
status: Available
suppressionDuration: PT1H
queryPeriod: 14d
requiredDataConnectors:
- connectorId: RedSiftPush
  dataTypes:
  - RedSiftAuth_CL
tactics:
- InitialAccess
query: |
  let lookback = 14d;
  let recentWindow = 1h;
  let historicalLogins = RedSiftAuth_CL
  | extend
      ActivityName = tostring(column_ifexists("ActivityName", "")),
      UserEmail = tostring(column_ifexists("UserEmail", "")),
      SrcIp = tostring(column_ifexists("SrcIp", ""))
  | where TimeGenerated between (ago(lookback) .. ago(recentWindow))
  | where ActivityName has "Logon"
  | where isnotempty(UserEmail) and isnotempty(SrcIp)
  | summarize by UserEmail, SrcIp;
  RedSiftAuth_CL
  | extend
      ActivityName = tostring(column_ifexists("ActivityName", "")),
      UserEmail = tostring(column_ifexists("UserEmail", "")),
      SrcIp = tostring(column_ifexists("SrcIp", "")),
      HttpUserAgent = tostring(column_ifexists("HttpUserAgent", "")),
      ServiceName = tostring(column_ifexists("ServiceName", "")),
      Severity = tostring(column_ifexists("Severity", ""))
  | where TimeGenerated >= ago(recentWindow)
  | where ActivityName has "Logon"
  | where isnotempty(UserEmail) and isnotempty(SrcIp)
  | join kind=leftanti (historicalLogins) on UserEmail, SrcIp
  | project
      TimeGenerated,
      UserEmail,
      SrcIp,
      HttpUserAgent,
      ServiceName,
      ActivityName,
      Severity
description: |
  'Detects a successful login from an IP address that has not been seen in the previous 14 days for that user, which may indicate compromised credentials or unauthorized access.'
severity: Medium
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: P1D
    groupByEntities:
    - Account
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
  createIncident: true
id: c3d4e5f6-a7b8-9012-cdef-123456789012
customDetails:
  UserAgent: HttpUserAgent
  ServiceName: ServiceName
suppressionEnabled: false
triggerThreshold: 0
queryFrequency: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDescriptionFormat: User {{UserEmail}} logged in from a previously unseen IP address {{SrcIp}}.
  alertDisplayNameFormat: RedSift - New IP Login for {{UserEmail}}
version: 1.0.1
relevantTechniques:
- T1078

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c3d4e5f6-a7b8-9012-cdef-123456789012')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c3d4e5f6-a7b8-9012-cdef-123456789012')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User {{UserEmail}} logged in from a previously unseen IP address {{SrcIp}}.",
          "alertDisplayNameFormat": "RedSift - New IP Login for {{UserEmail}}"
        },
        "alertRuleTemplateName": "c3d4e5f6-a7b8-9012-cdef-123456789012",
        "customDetails": {
          "ServiceName": "ServiceName",
          "UserAgent": "HttpUserAgent"
        },
        "description": "'Detects a successful login from an IP address that has not been seen in the previous 14 days for that user, which may indicate compromised credentials or unauthorized access.'\n",
        "displayName": "Red Sift - Login from previously unseen IP address",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Red%20Sift/Analytic%20Rules/RedSiftLoginFromNewIP.yaml",
        "query": "let lookback = 14d;\nlet recentWindow = 1h;\nlet historicalLogins = RedSiftAuth_CL\n| extend\n    ActivityName = tostring(column_ifexists(\"ActivityName\", \"\")),\n    UserEmail = tostring(column_ifexists(\"UserEmail\", \"\")),\n    SrcIp = tostring(column_ifexists(\"SrcIp\", \"\"))\n| where TimeGenerated between (ago(lookback) .. ago(recentWindow))\n| where ActivityName has \"Logon\"\n| where isnotempty(UserEmail) and isnotempty(SrcIp)\n| summarize by UserEmail, SrcIp;\nRedSiftAuth_CL\n| extend\n    ActivityName = tostring(column_ifexists(\"ActivityName\", \"\")),\n    UserEmail = tostring(column_ifexists(\"UserEmail\", \"\")),\n    SrcIp = tostring(column_ifexists(\"SrcIp\", \"\")),\n    HttpUserAgent = tostring(column_ifexists(\"HttpUserAgent\", \"\")),\n    ServiceName = tostring(column_ifexists(\"ServiceName\", \"\")),\n    Severity = tostring(column_ifexists(\"Severity\", \"\"))\n| where TimeGenerated >= ago(recentWindow)\n| where ActivityName has \"Logon\"\n| where isnotempty(UserEmail) and isnotempty(SrcIp)\n| join kind=leftanti (historicalLogins) on UserEmail, SrcIp\n| project\n    TimeGenerated,\n    UserEmail,\n    SrcIp,\n    HttpUserAgent,\n    ServiceName,\n    ActivityName,\n    Severity\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}