Claroty - Multiple failed logins to same destinations

Status: available
Severity: high
Time window: 5m
Group by: Site
Source: github.com/Azure/Azure-Sentinel

Detects multiple failed login attempts to the same Claroty SRA destination site within a 5-minute window. The rule counts failed logins per site and alerts when the number of failures exceeds the threshold value of 10.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application

Rule body

id: 1c2310ef-19bf-4caf-b2b0-a4c983932fa5
name: Claroty - Multiple failed logins to same destinations
description: 'Detects multiple failed login attempts to the same Claroty SRA destination site within a 5-minute window. The
  rule counts failed logins per site and alerts when the number of failures exceeds the threshold value of 10.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1133
query: |
  let threshold = 10;
    ClarotyEvent
    | where EventType has 'Login to SRA'
    | where EventType !has 'succeeded'
    | extend Site = column_ifexists("site_name","")
    | where isnotempty(Site)
    | extend SrcUsername = extract(@'User\s(.*?)\sfailed', 1, EventMessage)
    | summarize FailedLogins = count(), SampleUser = any(SrcUsername) by Site, bin(TimeGenerated, 5m)
    | where FailedLogins > threshold
    | extend SGCustomEntity = Site
    | project TimeGenerated, Site, FailedLogins, Threshold = threshold, SampleUser, SGCustomEntity
entityMappings:
- entityType: SecurityGroup
  fieldMappings:
  - identifier: DistinguishedName
    columnName: SGCustomEntity
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 10;

Stage 1: `source`

ClarotyEvent

Stage 2: `where`

| where EventType has 'Login to SRA'

Stage 3: `where`

| where EventType !has 'succeeded'

Stage 4: `extend`

| extend Site = column_ifexists("site_name","")

Stage 5: `where`

| where isnotempty(Site)

Stage 6: `extend`

| extend SrcUsername = extract(@'User\s(.*?)\sfailed', 1, EventMessage)

Stage 7: `summarize`

| summarize FailedLogins = count(), SampleUser = any(SrcUsername) by Site, bin(TimeGenerated, 5m)

Stage 8: `where`

| where FailedLogins > threshold

Stage 9: `extend`

| extend SGCustomEntity = Site

Stage 10: `project`

| project TimeGenerated, Site, FailedLogins, Threshold = threshold, SampleUser, SGCustomEntity

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`EventType`	match	`succeeded`	`excludes:EventType` `field:"EventType" value:"succeeded"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	match	`Login to SRA` transforms: `term`	`field:"EventType" kind:match value:"Login to SRA"`
`FailedLogins`	gt	`10`	`field:"FailedLogins" kind:gt value:"10"`
`Site`	is_not_null	(no value, null check)	`field:"Site" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`FailedLogins`	`project`
`SGCustomEntity`	`project`
`SampleUser`	`project`
`Site`	`project`
`Threshold`	`project`
`TimeGenerated`	`project`

Claroty - Multiple failed logins to same destinations

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: where

Stage 6: extend

Stage 7: summarize

Stage 8: where

Stage 9: extend

Stage 10: project