Successful logins to SOC Prime platform from bad IP addresses

Back


Id	f8e7d6c5-b4a3-4122-8110-0987654321fe
Rulename	Successful logins to SOC Prime platform from bad IP addresses
Description	This rule identifies successful logins from IP addresses previously flagged as malicious (e.g., botnets, TOR exit nodes, or known malicious IPs)
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	SOCPrimeAuditLogsDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SOC Prime CCF/Analytic Rules/SuccessLoginFromBadIp.yaml
Version	1.0.0
Arm template	f8e7d6c5-b4a3-4122-8110-0987654321fe.json

KQL

let blacklistIPs = _GetWatchlist('blacklistOfIps')
| project IPAddress = column_ifexists('ip','IPAddress');
SOCPrimeAuditLogs_CL
| where EventName == "Logged in to the SOC Prime Platform"
| where SourceIp in (blacklistIPs)
| project TimeGenerated, EventName, UserEmail, UserName, SourceIp, Uri, Type

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: UserName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIp
tactics:
- InitialAccess
requiredDataConnectors:
- dataTypes:
  - SOCPrimeAuditLogs_CL
  connectorId: SOCPrimeAuditLogsDataConnector
id: f8e7d6c5-b4a3-4122-8110-0987654321fe
severity: Medium
status: Available
query: |
  let blacklistIPs = _GetWatchlist('blacklistOfIps')
  | project IPAddress = column_ifexists('ip','IPAddress');
  SOCPrimeAuditLogs_CL
  | where EventName == "Logged in to the SOC Prime Platform"
  | where SourceIp in (blacklistIPs)
  | project TimeGenerated, EventName, UserEmail, UserName, SourceIp, Uri, Type  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SOC Prime CCF/Analytic Rules/SuccessLoginFromBadIp.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.0
name: Successful logins to SOC Prime platform from bad IP addresses
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1078
description: |
    'This rule identifies successful logins from IP addresses previously flagged as malicious (e.g., botnets, TOR exit nodes, or known malicious IPs)'
triggerOperator: gt

ARM