Detection rules › Kusto
Mimecast Audit - Logon Authentication Failed
Detects threat when logon authentication failure found in audit
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1110 Brute Force |
Rule body kusto
id: 9c5dcd76-9f6d-42a3-b984-314b52678f20
name: Mimecast Audit - Logon Authentication Failed
apiVersion: 2021-09-01-preview
description: Detects threat when logon authentication failure found in audit
displayName: Mimecast Audit - Logon Authentication Failed
severity: High
requiredDataConnectors:
- connectorId: MimecastAuditAPI
dataTypes:
- MimecastAudit_CL
enabled: true
query: MimecastAudit_CL | where src_s !="" and auditType_s == "Logon Authentication Failed"
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 3
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Discovery
- InitialAccess
- CredentialAccess
relevantTechniques:
- T1110
alertRuleTemplateName:
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 1d
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: SingleAlert
alertDetailsOverride:
customDetails:
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: src_s
- entityType: Mailbox
fieldMappings:
- identifier: MailboxPrimaryAddress
columnName: user_s
- entityType: CloudApplication
fieldMappings:
- identifier: AppId
columnName: app_s
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastAudit_CL
Stage 2: where
| where src_s !="" and auditType_s == "Logon Authentication Failed"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
auditType_s | eq |
|