Speculus - Sign-in attempt from high-risk IP indicator

Back


Id	e1b8d4a6-9c27-45f3-8a1e-7f2c0d9b5e64
Rulename	Speculus - Sign-in attempt from high-risk IP indicator
Description	Matches Microsoft Entra ID sign-in attempts against high-risk Speculus IP indicators (risk score >= 75) received in the last 14 days. A sign-in from a known C2, botnet, or brute-force source IP may indicate credential theft or account takeover.
Severity	High
Tactics	InitialAccess CredentialAccess
Techniques	T1078 T1110
Required data connectors	AzureActiveDirectory SpeculusThreatIntel
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Speculus%20Threat%20Intelligence/Analytic%20Rules/Speculus%20-%20IP%20Indicator%20Match%20SigninLogs.yaml
Version	1.0.0
Arm template	e1b8d4a6-9c27-45f3-8a1e-7f2c0d9b5e64.json

KQL

let indicators = Speculus_Indicators_CL
    | where TimeGenerated > ago(14d)
    | where isnotempty(IndicatorValue)
    | where RiskScore >= 75
    | summarize arg_max(Modified, *) by IndicatorValue
    | project
        IndicatorValue,
        RiskScore,
        SpeculusActivity = Activity,
        Attribution,
        Labels,
        IndicatorDescription = Description;
SigninLogs
| where TimeGenerated > ago(1h)
| where isnotempty(IPAddress)
| join kind=inner indicators on $left.IPAddress == $right.IndicatorValue
| project
    TimeGenerated,
    IPAddress,
    UserPrincipalName,
    UserDisplayName,
    AppDisplayName,
    ResultType,
    ResultDescription,
    RiskScore,
    SpeculusActivity,
    Attribution,
    Labels,
    IndicatorDescription

YAML

tactics:
- InitialAccess
- CredentialAccess
name: Speculus - Sign-in attempt from high-risk IP indicator
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Speculus%20Threat%20Intelligence/Analytic%20Rules/Speculus%20-%20IP%20Indicator%20Match%20SigninLogs.yaml
version: 1.0.0
queryFrequency: 1h
requiredDataConnectors:
- connectorId: SpeculusThreatIntel
  dataTypes:
  - Speculus_Indicators_CL
- connectorId: AzureActiveDirectory
  dataTypes:
  - SigninLogs
customDetails:
  RiskScore: RiskScore
  Attribution: Attribution
  Labels: Labels
id: e1b8d4a6-9c27-45f3-8a1e-7f2c0d9b5e64
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPAddress
  entityType: IP
- fieldMappings:
  - identifier: FullName
    columnName: UserPrincipalName
  entityType: Account
queryPeriod: 14d
severity: High
relevantTechniques:
- T1078
- T1110
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionEnabled: false
description: |
  'Matches Microsoft Entra ID sign-in attempts against high-risk Speculus IP indicators (risk score >= 75)
  received in the last 14 days. A sign-in from a known C2, botnet, or brute-force source IP may indicate
  credential theft or account takeover.'
triggerOperator: gt
suppressionDuration: 1h
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    matchingMethod: Selected
    lookbackDuration: 1d
    reopenClosedIncident: false
    groupByEntities:
    - Account
    - IP
kind: Scheduled
query: |
  let indicators = Speculus_Indicators_CL
      | where TimeGenerated > ago(14d)
      | where isnotempty(IndicatorValue)
      | where RiskScore >= 75
      | summarize arg_max(Modified, *) by IndicatorValue
      | project
          IndicatorValue,
          RiskScore,
          SpeculusActivity = Activity,
          Attribution,
          Labels,
          IndicatorDescription = Description;
  SigninLogs
  | where TimeGenerated > ago(1h)
  | where isnotempty(IPAddress)
  | join kind=inner indicators on $left.IPAddress == $right.IndicatorValue
  | project
      TimeGenerated,
      IPAddress,
      UserPrincipalName,
      UserDisplayName,
      AppDisplayName,
      ResultType,
      ResultDescription,
      RiskScore,
      SpeculusActivity,
      Attribution,
      Labels,
      IndicatorDescription

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e1b8d4a6-9c27-45f3-8a1e-7f2c0d9b5e64')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e1b8d4a6-9c27-45f3-8a1e-7f2c0d9b5e64')]",
      "properties": {
        "alertRuleTemplateName": "e1b8d4a6-9c27-45f3-8a1e-7f2c0d9b5e64",
        "customDetails": {
          "Attribution": "Attribution",
          "Labels": "Labels",
          "RiskScore": "RiskScore"
        },
        "description": "'Matches Microsoft Entra ID sign-in attempts against high-risk Speculus IP indicators (risk score >= 75)\nreceived in the last 14 days. A sign-in from a known C2, botnet, or brute-force source IP may indicate\ncredential theft or account takeover.'\n",
        "displayName": "Speculus - Sign-in attempt from high-risk IP indicator",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserPrincipalName",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account",
              "IP"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Speculus%20Threat%20Intelligence/Analytic%20Rules/Speculus%20-%20IP%20Indicator%20Match%20SigninLogs.yaml",
        "query": "let indicators = Speculus_Indicators_CL\n    | where TimeGenerated > ago(14d)\n    | where isnotempty(IndicatorValue)\n    | where RiskScore >= 75\n    | summarize arg_max(Modified, *) by IndicatorValue\n    | project\n        IndicatorValue,\n        RiskScore,\n        SpeculusActivity = Activity,\n        Attribution,\n        Labels,\n        IndicatorDescription = Description;\nSigninLogs\n| where TimeGenerated > ago(1h)\n| where isnotempty(IPAddress)\n| join kind=inner indicators on $left.IPAddress == $right.IndicatorValue\n| project\n    TimeGenerated,\n    IPAddress,\n    UserPrincipalName,\n    UserDisplayName,\n    AppDisplayName,\n    ResultType,\n    ResultDescription,\n    RiskScore,\n    SpeculusActivity,\n    Attribution,\n    Labels,\n    IndicatorDescription\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1110"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}