CiscoISE - ISE administrator password has been reset

Back


Id	e63b4d90-d0a8-4609-b187-babfcc7f86d7
Rulename	CiscoISE - ISE administrator password has been reset
Description	Detects when the ISE administrator password has been reset.
Severity	Medium
Tactics	Persistence PrivilegeEscalation
Techniques	T1098
Required data connectors	CiscoISE SyslogAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml
Version	1.0.2
Arm template	e63b4d90-d0a8-4609-b187-babfcc7f86d7.json

KQL

let lbtime = 5m;
CiscoISEEvent
| where TimeGenerated > ago(lbtime)
| where EventId == '58019'
| project TimeGenerated, SrcIpAddr, DstUserName
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

status: Available
queryFrequency: 5m
description: |
    'Detects when the ISE administrator password has been reset.'
severity: Medium
version: 1.0.2
relevantTechniques:
- T1098
name: CiscoISE - ISE administrator password has been reset
triggerThreshold: 0
kind: Scheduled
query: |
  let lbtime = 5m;
  CiscoISEEvent
  | where TimeGenerated > ago(lbtime)
  | where EventId == '58019'
  | project TimeGenerated, SrcIpAddr, DstUserName
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml
requiredDataConnectors:
- connectorId: CiscoISE
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  datatypes:
  - Syslog
tactics:
- Persistence
- PrivilegeEscalation
id: e63b4d90-d0a8-4609-b187-babfcc7f86d7
queryPeriod: 5m
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e63b4d90-d0a8-4609-b187-babfcc7f86d7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e63b4d90-d0a8-4609-b187-babfcc7f86d7')]",
      "properties": {
        "alertRuleTemplateName": "e63b4d90-d0a8-4609-b187-babfcc7f86d7",
        "customDetails": null,
        "description": "'Detects when the ISE administrator password has been reset.'\n",
        "displayName": "CiscoISE - ISE administrator password has been reset",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml",
        "query": "let lbtime = 5m;\nCiscoISEEvent\n| where TimeGenerated > ago(lbtime)\n| where EventId == '58019'\n| project TimeGenerated, SrcIpAddr, DstUserName\n| extend AccountCustomEntity = DstUserName\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1098"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}