CiscoISE - ISE administrator password has been reset

Back


Id	e63b4d90-d0a8-4609-b187-babfcc7f86d7
Rulename	CiscoISE - ISE administrator password has been reset
Description	Detects when the ISE administrator password has been reset.
Severity	Medium
Tactics	Persistence PrivilegeEscalation
Techniques	T1098
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml
Version	1.0.3
Arm template	e63b4d90-d0a8-4609-b187-babfcc7f86d7.json

KQL

let lbtime = 5m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId == '58019'
| project TimeGenerated, SrcIpAddr, DstUserName
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

description: |
    'Detects when the ISE administrator password has been reset.'
kind: Scheduled
tactics:
- Persistence
- PrivilegeEscalation
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml
severity: Medium
name: CiscoISE - ISE administrator password has been reset
triggerThreshold: 0
queryPeriod: 5m
query: |
  let lbtime = 5m;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where EventId == '58019'
  | project TimeGenerated, SrcIpAddr, DstUserName
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
relevantTechniques:
- T1098
id: e63b4d90-d0a8-4609-b187-babfcc7f86d7
queryFrequency: 5m
status: Available
triggerOperator: gt
version: 1.0.3
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address

ARM