Ping Federate - Unusual mail domain

Back


Id	dc79de7d-2590-4852-95fb-f8e02b34f4da
Rulename	Ping Federate - Unusual mail domain.
Description	Detects unusual mail domain in authentication requests.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	CefAma PingFederate PingFederateAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnusualMailDomain.yaml
Version	1.0.2
Arm template	dc79de7d-2590-4852-95fb-f8e02b34f4da.json

KQL

let known_domains = 
PingFederateEvent
| where TimeGenerated between (ago(14d) .. (1d))
| extend email = extract(@'email=(.*?),.*', 1, AdditionalExtensions)
| extend m_domain = extract(@'@(.*)', 1, email)
| where isnotempty(m_domain)
| summarize makeset(m_domain);
PingFederateEvent
| extend email = extract(@'email=(.*?),.*', 1, AdditionalExtensions)
| extend m_domain = extract(@'@(.*)', 1, email)
| where isnotempty(m_domain)
| where m_domain !in (known_domains)
| extend AccountCustomEntity = DstUserName
| extend IpCustomEntity = SrcIpAddr

YAML

relevantTechniques:
- T1078
name: Ping Federate - Unusual mail domain.
requiredDataConnectors:
- dataTypes:
  - PingFederateEvent
  connectorId: PingFederate
- dataTypes:
  - PingFederateEvent
  connectorId: PingFederateAma
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IpCustomEntity
  entityType: IP
triggerThreshold: 0
id: dc79de7d-2590-4852-95fb-f8e02b34f4da
tactics:
- InitialAccess
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnusualMailDomain.yaml
queryPeriod: 14d
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Detects unusual mail domain in authentication requests.'
query: |
  let known_domains = 
  PingFederateEvent
  | where TimeGenerated between (ago(14d) .. (1d))
  | extend email = extract(@'email=(.*?),.*', 1, AdditionalExtensions)
  | extend m_domain = extract(@'@(.*)', 1, email)
  | where isnotempty(m_domain)
  | summarize makeset(m_domain);
  PingFederateEvent
  | extend email = extract(@'email=(.*?),.*', 1, AdditionalExtensions)
  | extend m_domain = extract(@'@(.*)', 1, email)
  | where isnotempty(m_domain)
  | where m_domain !in (known_domains)
  | extend AccountCustomEntity = DstUserName
  | extend IpCustomEntity = SrcIpAddr  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dc79de7d-2590-4852-95fb-f8e02b34f4da')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dc79de7d-2590-4852-95fb-f8e02b34f4da')]",
      "properties": {
        "alertRuleTemplateName": "dc79de7d-2590-4852-95fb-f8e02b34f4da",
        "customDetails": null,
        "description": "'Detects unusual mail domain in authentication requests.'\n",
        "displayName": "Ping Federate - Unusual mail domain.",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IpCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateUnusualMailDomain.yaml",
        "query": "let known_domains = \nPingFederateEvent\n| where TimeGenerated between (ago(14d) .. (1d))\n| extend email = extract(@'email=(.*?),.*', 1, AdditionalExtensions)\n| extend m_domain = extract(@'@(.*)', 1, email)\n| where isnotempty(m_domain)\n| summarize makeset(m_domain);\nPingFederateEvent\n| extend email = extract(@'email=(.*?),.*', 1, AdditionalExtensions)\n| extend m_domain = extract(@'@(.*)', 1, email)\n| where isnotempty(m_domain)\n| where m_domain !in (known_domains)\n| extend AccountCustomEntity = DstUserName\n| extend IpCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}