API - Password Cracking

Back


Id	d951d64d-0ecd-4675-8c79-6c870d5f72ac
Rulename	API - Password Cracking
Description	42Crunch API protection against password cracking
Severity	High
Tactics	CredentialAccess
Techniques	T1110 T1555 T1187
Required data connectors	42CrunchAPIProtection FortyTwoCrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIPasswordCracking.yaml
Version	3.0.1
Arm template	d951d64d-0ecd-4675-8c79-6c870d5f72ac.json

KQL

let loginRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login?user=" and Status == 403;
let recCount = iff((toscalar(loginRec | count) > 10), 1, 0);
loginRec | take recCount

YAML

status: Available
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
query: |
  let loginRec = FortyTwoCrunchAPIProtection
  | where TimeGenerated >= ago(5m) 
  | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
  | where UriPath has "/api/login?user=" and Status == 403;
  let recCount = iff((toscalar(loginRec | count) > 10), 1, 0);
  loginRec | take recCount  
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIPasswordCracking.yaml
tactics:
- CredentialAccess
triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIp
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Hostname
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: InstanceName
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
  dataTypes:
  - FortyTwoCrunchAPIProtection
kind: Scheduled
relevantTechniques:
- T1110
- T1555
- T1187
customDetails: 
description: |
    '42Crunch API protection against password cracking'
name: API - Password Cracking
version: 3.0.1
id: d951d64d-0ecd-4675-8c79-6c870d5f72ac
severity: High

ARM