HoneyLabs TI Map IP Entity to SigninLogs

Severity: medium
Time window: 14d
Group by: CS_ipEntity, Id, TI_ipEntity
Source: github.com/Azure/Azure-Sentinel

Identifies sign-ins (interactive and non-interactive) from IP addresses that HoneyLabs honeypot telemetry has observed running exploit or loader commands. A hit means credential access is being attempted from infrastructure with recent, evidenced malicious activity. Indicator Confidence reflects how much evidence HoneyLabs holds (90 = 100+ observed attacks, 60 = a single sighting); raise the threshold in the query to trade coverage for precision.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Credential Access	`T1110` Brute Force

Telemetry coverage

Platform	Record / event type
Azure	any: Sign-in record (AADNonInteractiveUserSignInLogs, any result)
Entra ID	`SigninLogs` sign-in event: Sign-in record (SigninLogs, any result)

Rule body

id: a573396f-06ed-4139-bccc-e0f88a2cf625
name: HoneyLabs TI Map IP Entity to SigninLogs
version: 1.0.0
kind: Scheduled
description: |
  'Identifies sign-ins (interactive and non-interactive) from IP addresses that HoneyLabs honeypot telemetry has observed running exploit or loader commands. A hit means credential access is being attempted from infrastructure with recent, evidenced malicious activity. Indicator Confidence reflects how much evidence HoneyLabs holds (90 = 100+ observed attacks, 60 = a single sighting); raise the threshold in the query to trade coverage for precision.'
severity: Medium
requiredDataConnectors:
  - connectorId: ThreatIntelligenceTaxii
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AADNonInteractiveUserSignInLogs
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - CredentialAccess
relevantTechniques:
  - T1190
  - T1110
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let HoneyLabs_IPs = ThreatIntelIndicators
    | where TimeGenerated >= ago(ioc_lookBack)
    | where IsActive == true and ValidUntil > now()
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
    | where SourceSystem startswith 'HoneyLabs'
    | where ObservableKey == 'ipv4-addr:value'
    | extend TI_ipEntity = tostring(ObservableValue),
             HoneyLabsConfidence = Confidence,
             HoneyLabsLabels = tostring(Data.labels),
             IndicatorDescription = tostring(Data.description),
             HoneyLabsReport = strcat('https://honeylabs.net/lookup/', tostring(ObservableValue));
  let aadSignin = SigninLogs | where TimeGenerated >= ago(dt_lookBack)
    | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;
  let aadNonInt = AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(dt_lookBack)
    | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;
  HoneyLabs_IPs
  | join kind=innerunique (union isfuzzy=true aadSignin, aadNonInt
      | extend CS_ipEntity = IPAddress
      | extend Signin_TimeGenerated = TimeGenerated
  ) on $left.TI_ipEntity == $right.CS_ipEntity
  | where Signin_TimeGenerated < ValidUntil
  | summarize Signin_TimeGenerated = arg_max(Signin_TimeGenerated, *) by Id, CS_ipEntity
  | project Signin_TimeGenerated, IndicatorDescription, Id, ValidUntil, HoneyLabsConfidence,
    HoneyLabsLabels, HoneyLabsReport, TI_ipEntity, CS_ipEntity, UserPrincipalName, ResultType,
    AppDisplayName, Location
  | extend timestamp = Signin_TimeGenerated
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: CS_ipEntity
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserPrincipalName

Stages and Predicates

Parameters

let dt_lookBack = 1h;
let ioc_lookBack = 14d;

let HoneyLabs_IPs is inlined into the numbered stages below.

Let binding: `aadSignin` used in Stage 8

let aadSignin = SigninLogs | where TimeGenerated >= ago(dt_lookBack)
  | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;

Let binding: `aadNonInt` used in Stage 8

let aadNonInt = AADNonInteractiveUserSignInLogs | where TimeGenerated >= ago(dt_lookBack)
  | project TimeGenerated, IPAddress, UserPrincipalName, ResultType, AppDisplayName, Location;

Stages 1 to 7 define let HoneyLabs_IPs (the rule's main pipeline source); stages 8 to 12 run on it.

Stage 1: `source`

ThreatIntelIndicators

Stage 2: `where`

| where TimeGenerated >= ago(ioc_lookBack)

Stage 3: `where`

| where IsActive == true and ValidUntil > now()

Stage 4: `summarize`

| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id

Stage 5: `where`

| where SourceSystem startswith 'HoneyLabs'

Stage 6: `where`

| where ObservableKey == 'ipv4-addr:value'

Stage 7: `extend`

| extend TI_ipEntity = tostring(ObservableValue),
           HoneyLabsConfidence = Confidence,
           HoneyLabsLabels = tostring(Data.labels),
           IndicatorDescription = tostring(Data.description),
           HoneyLabsReport = strcat('https://honeylabs.net/lookup/', tostring(ObservableValue))

Stage 8: `join`

HoneyLabs_IPs
| join kind=innerunique (union isfuzzy=true aadSignin, aadNonInt
    | extend CS_ipEntity = IPAddress
    | extend Signin_TimeGenerated = TimeGenerated
) on $left.TI_ipEntity == $right.CS_ipEntity

Stage 9: `where`

| where Signin_TimeGenerated < ValidUntil

Stage 10: `summarize`

| summarize Signin_TimeGenerated = arg_max(Signin_TimeGenerated, *) by Id, CS_ipEntity

Stage 11: `project`

| project Signin_TimeGenerated, IndicatorDescription, Id, ValidUntil, HoneyLabsConfidence,
  HoneyLabsLabels, HoneyLabsReport, TI_ipEntity, CS_ipEntity, UserPrincipalName, ResultType,
  AppDisplayName, Location

Stage 12: `extend`

| extend timestamp = Signin_TimeGenerated

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`IsActive`	eq	`true`	`field:"IsActive" kind:eq value:"true"`
`ObservableKey`	eq	`ipv4-addr:value`	`field:"ObservableKey" kind:eq value:"ipv4-addr:value"`
`Signin_TimeGenerated`	cross_field_compare	`ValidUntil` transforms: `op:lt`	`field:"Signin_TimeGenerated" kind:cross_field_compare value:"ValidUntil"`
`SourceSystem`	starts_with	`HoneyLabs`	`field:"SourceSystem" kind:starts_with value:"HoneyLabs"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AppDisplayName`	`project`
`CS_ipEntity`	`project`
`HoneyLabsConfidence`	`project`
`HoneyLabsLabels`	`project`
`HoneyLabsReport`	`project`
`Id`	`project`
`IndicatorDescription`	`project`
`Location`	`project`
`ResultType`	`project`
`Signin_TimeGenerated`	`project`
`TI_ipEntity`	`project`
`UserPrincipalName`	`project`
`ValidUntil`	`project`
`timestamp`	`extend`

HoneyLabs TI Map IP Entity to SigninLogs

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Parameters

Let binding: aadSignin used in Stage 8

Let binding: aadNonInt used in Stage 8

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: where

Stage 6: where

Stage 7: extend

Stage 8: join

Stage 9: where

Stage 10: summarize

Stage 11: project

Stage 12: extend