Excessive Failed Authentication from Invalid Inputs

Back


Id	c775a46b-21b1-46d7-afa6-37e3e577a27b
Rulename	Excessive Failed Authentication from Invalid Inputs
Description	Creates an incident in the event that a user generates an excessive amount of failed authentications due to invalid inputs, indications of a potential brute force.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec VIP/Analytic Rules/ExcessiveFailedAuthenticationsfromInvalidInputs.yaml
Version	1.0.4
Arm template	c775a46b-21b1-46d7-afa6-37e3e577a27b.json

KQL

let threshold = 15;
SymantecVIP
| where isnotempty(RADIUSAuth)
| where RADIUSAuth =~ "Reject"
| summarize Total = count() by bin(TimeGenerated, 15m), User, ClientIP
| where Total > threshold

YAML

triggerThreshold: 0
version: 1.0.4
queryFrequency: 1h
id: c775a46b-21b1-46d7-afa6-37e3e577a27b
severity: Medium
relevantTechniques:
- T1110
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
description: |
    'Creates an incident in the event that a user generates an excessive amount of failed authentications due to invalid inputs, indications of a potential brute force.'
triggerOperator: gt
tactics:
- CredentialAccess
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: User
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: ClientIP
  entityType: IP
queryPeriod: 1h
kind: Scheduled
status: Available
query: |
  let threshold = 15;
  SymantecVIP
  | where isnotempty(RADIUSAuth)
  | where RADIUSAuth =~ "Reject"
  | summarize Total = count() by bin(TimeGenerated, 15m), User, ClientIP
  | where Total > threshold  
name: Excessive Failed Authentication from Invalid Inputs
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Symantec VIP/Analytic Rules/ExcessiveFailedAuthenticationsfromInvalidInputs.yaml

ARM