ClientDeniedAccess

Status: available
Severity: medium
Time window: 1h
Group by: ClientIP, User
Source: github.com/Azure/Azure-Sentinel

'Creates an incident in the event a Client has an excessive amounts of denied access requests.'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Rule body

id: a9956d3a-07a9-44a6-a279-081a85020cae
name: ClientDeniedAccess
description: |
  'Creates an incident in the event a Client has an excessive amounts of denied access requests.'
severity: Medium
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  let threshold = 15;
  let rejectedAccess = SymantecVIP
  | where isnotempty(RADIUSAuth)
  | where RADIUSAuth =~ "Reject"
  | summarize Total = count() by ClientIP, bin(TimeGenerated, 15m)
  | where Total > threshold
  | project ClientIP;
  SymantecVIP
  | where isnotempty(RADIUSAuth)
  | where RADIUSAuth =~ "Reject"
  | join kind=inner rejectedAccess on ClientIP
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by ClientIP, User
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIP
version: 1.0.4
status: Available
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 15;

Let binding: `rejectedAccess` used in Stage 4

let rejectedAccess = SymantecVIP
| where isnotempty(RADIUSAuth)
| where RADIUSAuth =~ "Reject"
| summarize Total = count() by ClientIP, bin(TimeGenerated, 15m)
| where Total > threshold
| project ClientIP;

Stage 1: `source`

SymantecVIP

Stage 2: `where`

| where isnotempty(RADIUSAuth)

Stage 3: `where`

| where RADIUSAuth =~ "Reject"

Stage 4: `join`

| join kind=inner rejectedAccess on ClientIP

Stage 5: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by ClientIP, User

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`RADIUSAuth`	eq	`Reject`	`field:"RADIUSAuth" kind:eq value:"Reject"`
`RADIUSAuth`	is_not_null	(no value, null check)	`field:"RADIUSAuth" kind:is_not_null`
`Total`	gt	`15`	`field:"Total" kind:gt value:"15"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ClientIP`	`summarize`
`EndTime`	`summarize`
`StartTime`	`summarize`
`User`	`summarize`

ClientDeniedAccess

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: rejectedAccess used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: join

Stage 5: summarize

Indicators

Output fields

Let binding: `rejectedAccess` used in Stage 4

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `join`

Stage 5: `summarize`