Samsung Knox - Password Lockout Events

Back


Id	fbff0a97-1972-4df8-a78c-254ccb9879ef
Rulename	Samsung Knox - Password Lockout Events
Description	When maximum password attempts have been reached, and the Knox device is locked out. This is based on a threshold set in the MDM device policy
Severity	High
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	SamsungDCDefinition
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPasswordLockout.yaml
Version	1.0.2
Arm template	fbff0a97-1972-4df8-a78c-254ccb9879ef.json

KQL

Samsung_Knox_User_CL 
| where Name == "PASSWORD_LOCKOUT"
and MitreTtp has "T1110"

YAML

status: Available
relevantTechniques:
- T1110
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    reopenClosedIncident: false
version: 1.0.2
name: Samsung Knox - Password Lockout Events
id: fbff0a97-1972-4df8-a78c-254ccb9879ef
suppressionEnabled: false
tactics:
- CredentialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPasswordLockout.yaml
requiredDataConnectors:
- dataTypes:
  - Samsung_Knox_User_CL
  connectorId: SamsungDCDefinition
suppressionDuration: PT5H
query: |
  Samsung_Knox_User_CL 
  | where Name == "PASSWORD_LOCKOUT"
  and MitreTtp has "T1110"  
eventGroupingSettings:
  aggregationKind: SingleAlert
severity: High
kind: NRT
description: When maximum password attempts have been reached, and the Knox device is locked out. This is based on a threshold set in the MDM device policy

ARM