Claroty - Multiple failed logins by user

Status: available
Severity: high
Time window: 5m
Group by: SrcUsername
Source: github.com/Azure/Azure-Sentinel

Detects multiple failed logins by the same user in Claroty SRA event logs. The rule looks for failed Login to SRA events, extracts the source username from the event message, and alerts when a user exceeds 5 failed logins within 5 minutes.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application
Credential Access	`T1110` Brute Force

Rule body

id: 4b5bb3fc-c690-4f54-9a74-016213d699b4
name: Claroty - Multiple failed logins by user
description: 'Detects multiple failed logins by the same user in Claroty SRA event logs. The rule looks for failed Login to
  SRA events, extracts the source username from the event message, and alerts when a user exceeds 5 failed logins within 5
  minutes.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- CredentialAccess
- InitialAccess
relevantTechniques:
- T1110
- T1190
- T1133
query: |
    let threshold = 5;
    ClarotyEvent
    | where EventType has 'Login to SRA'
    | where EventType !has 'succeeded'
    | extend SrcUsername = trim(' ', tostring(extract(@'User\s(.*?)\sfailed', 1, EventMessage)))
    | where isnotempty(SrcUsername)
    | summarize FailedLogins = count() by SrcUsername, bin(TimeGenerated, 5m)
    | where FailedLogins > threshold
    | extend AccountCustomEntity = SrcUsername
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
alertDetailsOverride:
  alertDisplayNameFormat: Claroty multiple failed logins for {{SrcUsername}}
  alertDescriptionFormat: '{{FailedLogins}} failed logins for user {{SrcUsername}} exceeded the threshold in 5 minutes.'
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 5;

Stage 1: `source`

ClarotyEvent

Stage 2: `where`

| where EventType has 'Login to SRA'

Stage 3: `where`

| where EventType !has 'succeeded'

Stage 4: `extend`

| extend SrcUsername = trim(' ', tostring(extract(@'User\s(.*?)\sfailed', 1, EventMessage)))

Stage 5: `where`

| where isnotempty(SrcUsername)

Stage 6: `summarize`

| summarize FailedLogins = count() by SrcUsername, bin(TimeGenerated, 5m)

Stage 7: `where`

| where FailedLogins > threshold

Stage 8: `extend`

| extend AccountCustomEntity = SrcUsername

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`EventType`	match	`succeeded`	`excludes:EventType` `field:"EventType" value:"succeeded"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	match	`Login to SRA` transforms: `term`	`field:"EventType" kind:match value:"Login to SRA"`
`FailedLogins`	gt	`5`	`field:"FailedLogins" kind:gt value:"5"`
`SrcUsername`	is_not_null	(no value, null check)	`field:"SrcUsername" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`FailedLogins`	`summarize`
`SrcUsername`	`summarize`
`AccountCustomEntity`	`extend`

Claroty - Multiple failed logins by user

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: where

Stage 6: summarize

Stage 7: where

Stage 8: extend