PulseConnectSecure - Large Number of Distinct Failed User Logins

Status: available
Severity: medium
Time window: 15m
Group by: Computer
Source: github.com/Azure/Azure-Sentinel

'This query identifies evidence of failed login attempts from a large number of distinct users on a Pulse Connect Secure VPN server'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Rule body

id: 1fa1528e-f746-4794-8a41-14827f4cb798
name: PulseConnectSecure - Large Number of Distinct Failed User Logins
description: |
  'This query identifies evidence of failed login attempts from a large number of distinct users on a Pulse Connect Secure VPN server'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  let threshold = 100;
  PulseConnectSecure
  | where Messages startswith "Login failed"
  | summarize dcount(User) by Computer, bin(TimeGenerated, 15m)
  | where dcount_User > threshold
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 100;

Stage 1: `source`

PulseConnectSecure

Stage 2: `where`

| where Messages startswith "Login failed"

Stage 3: `summarize`

| summarize dcount(User) by Computer, bin(TimeGenerated, 15m)

Stage 4: `where`

| where dcount_User > threshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Messages`	starts_with	`Login failed`	`field:"Messages" kind:starts_with value:"Login failed"`
`dcount_User`	gt	`100`	`field:"dcount_User" kind:gt value:"100"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Computer`	`summarize`