CiscoISE - ISE administrator password has been reset

Back


Id	e63b4d90-d0a8-4609-b187-babfcc7f86d7
Rulename	CiscoISE - ISE administrator password has been reset
Description	Detects when the ISE administrator password has been reset.
Severity	Medium
Tactics	Persistence PrivilegeEscalation
Techniques	T1098
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml
Version	1.0.3
Arm template	e63b4d90-d0a8-4609-b187-babfcc7f86d7.json

KQL

let lbtime = 5m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId == '58019'
| project TimeGenerated, SrcIpAddr, DstUserName
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

queryFrequency: 5m
tactics:
- Persistence
- PrivilegeEscalation
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml
id: e63b4d90-d0a8-4609-b187-babfcc7f86d7
name: CiscoISE - ISE administrator password has been reset
triggerOperator: gt
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
kind: Scheduled
version: 1.0.3
description: |
    'Detects when the ISE administrator password has been reset.'
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
relevantTechniques:
- T1098
queryPeriod: 5m
severity: Medium
triggerThreshold: 0
query: |
  let lbtime = 5m;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where EventId == '58019'
  | project TimeGenerated, SrcIpAddr, DstUserName
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr

ARM