Acronis - Login from Abnormal IP - Low Occurrence

Severity: medium
Time window: 14d
Group by: initiator_ip
Source: github.com/Azure/Azure-Sentinel

Suspicious login from an IP address observed up to two times in the last two weeks.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Rule body

id: 84037130-a623-46c2-9144-0c0955ac4112
name: Acronis - Login from Abnormal IP - Low Occurrence
description: Suspicious login from an IP address observed up to two times in the last two weeks.
severity: Medium
query: |
    CommonSecurityLog
    | where DeviceVendor == "Acronis audit"
    | extend initiator_ip = tostring(parse_json(DeviceCustomString1).initiator_ip)
    | summarize LoginCount = count() by initiator_ip
    | where LoginCount <= 2
    | order by LoginCount asc
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
    - InitialAccess
relevantTechniques:
    - T1078
incidentConfiguration:
    createIncident: true
    groupingConfiguration:
        enabled: true
        reopenClosedIncident: true
        lookbackDuration: P7D
        matchingMethod: Selected
        groupByEntities:
            - IP
eventGroupingSettings:
    aggregationKind: AlertPerResult
alertDetailsOverride:
    alertDisplayNameFormat: 'Acronis - Login from Abnormal IP ({{initiator_ip}}) - Low Occurrence ({{LoginCount}})'
    alertDynamicProperties: []
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: initiator_ip
version: 1.0.0
kind: Scheduled
requiredDataConnectors: []

Stages and Predicates

Stage 1: `source`

CommonSecurityLog

Stage 2: `where`

| where DeviceVendor == "Acronis audit"

Stage 3: `extend`

| extend initiator_ip = tostring(parse_json(DeviceCustomString1).initiator_ip)

Stage 4: `summarize`

| summarize LoginCount = count() by initiator_ip

Stage 5: `where`

| where LoginCount <= 2

Stage 6: `sort`

| order by LoginCount asc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DeviceVendor`	eq	`Acronis audit`	`field:"DeviceVendor" kind:eq value:"Acronis audit"`
`LoginCount`	le	`2`	`field:"LoginCount" kind:le value:"2"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`LoginCount`	`summarize`
`initiator_ip`	`summarize`

Acronis - Login from Abnormal IP - Low Occurrence

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: summarize

Stage 5: where

Stage 6: sort

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `extend`

Stage 4: `summarize`

Stage 5: `where`

Stage 6: `sort`