PulseConnectSecure - Potential Brute Force Attempts

Status: available
Severity: low
Time window: 1h
Group by: Source_IP, User
Source: github.com/Azure/Azure-Sentinel

'This query identifies evidence of potential brute force attack by looking at multiple failed attempts to log into the VPN server'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Rule body

id: 34663177-8abf-4db1-b0a4-5683ab273f44
name: PulseConnectSecure - Potential Brute Force Attempts
description: |
  'This query identifies evidence of potential brute force attack by looking at multiple failed attempts to log into the VPN server'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  let threshold = 20;
  PulseConnectSecure
  | where Messages contains "Login failed"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by User, Source_IP
  | where count_ > threshold
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: Source_IP
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 20;

Stage 1: `source`

PulseConnectSecure

Stage 2: `where`

| where Messages contains "Login failed"

Stage 3: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by User, Source_IP

Stage 4: `where`

| where count_ > threshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Messages`	contains	`Login failed`	`field:"Messages" kind:contains value:"Login failed"`
`count_`	gt	`20`	`field:"count_" kind:gt value:"20"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`summarize`
`Source_IP`	`summarize`
`StartTime`	`summarize`
`User`	`summarize`