Ping Federate - Abnormal password reset attempts

Back


Id	e45a7334-2cb4-4690-8156-f02cac73d584
Rulename	Ping Federate - Abnormal password reset attempts
Description	Detects abnormal password reset attempts for user in short period of time.
Severity	High
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateAbnormalPasswordResetsAttempts.yaml
Version	1.0.3
Arm template	e45a7334-2cb4-4690-8156-f02cac73d584.json

KQL

let threshold = 10;
PingFederateEvent
| where EventType =~ 'PWD_RESET_REQUEST'
| summarize count() by DstUserName, bin(TimeGenerated, 30m)
| where count_ > threshold
| extend AccountCustomEntity = DstUserName

YAML

id: e45a7334-2cb4-4690-8156-f02cac73d584
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PingFederate/Analytic Rules/PingFederateAbnormalPasswordResetsAttempts.yaml
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
queryFrequency: 1d
queryPeriod: 1d
status: Available
query: |
  let threshold = 10;
  PingFederateEvent
  | where EventType =~ 'PWD_RESET_REQUEST'
  | summarize count() by DstUserName, bin(TimeGenerated, 30m)
  | where count_ > threshold
  | extend AccountCustomEntity = DstUserName  
name: Ping Federate - Abnormal password reset attempts
kind: Scheduled
tactics:
- CredentialAccess
severity: High
relevantTechniques:
- T1110
triggerThreshold: 0
version: 1.0.3
description: |
    'Detects abnormal password reset attempts for user in short period of time.'

ARM