Detection rules › Kusto

Mimecast Audit - Logon Authentication Failed

Severity
high
Time window
15m
Source
github.com/Azure/Azure-Sentinel

Detects threat when logon authentication failure found in audit

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110 Brute Force

Rule body kusto

id: 9c5dcd76-9f6d-42a3-b984-314b52678f20
name: Mimecast Audit - Logon Authentication Failed
apiVersion: 2021-09-01-preview
description: Detects threat when logon authentication failure found in audit
displayName: Mimecast Audit - Logon Authentication Failed
severity: High
requiredDataConnectors:
  - connectorId: MimecastAuditAPI
    dataTypes:
      - MimecastAudit_CL  
enabled: true
query: MimecastAudit_CL | where src_s !="" and auditType_s == "Logon Authentication Failed"
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 3
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Discovery
- InitialAccess
- CredentialAccess
relevantTechniques:
- T1110
alertRuleTemplateName:
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
customDetails:
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: src_s
- entityType: Mailbox
  fieldMappings:
  - identifier: MailboxPrimaryAddress
    columnName: user_s
- entityType: CloudApplication
  fieldMappings:
  - identifier: AppId
    columnName: app_s
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

MimecastAudit_CL

Stage 2: where

| where src_s !="" and auditType_s == "Logon Authentication Failed"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
auditType_seq
  • Logon Authentication Failed transforms: cased