detection.wiki

Detection rules › Kusto

PulseConnectSecure - Large Number of Distinct Failed User Logins

Status
available
Severity
medium
Time window
15m
Group by
Computer
Source
github.com/Azure/Azure-Sentinel

'This query identifies evidence of failed login attempts from a large number of distinct users on a Pulse Connect Secure VPN server'

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110 Brute Force

Rule body kusto

id: 1fa1528e-f746-4794-8a41-14827f4cb798
name: PulseConnectSecure - Large Number of Distinct Failed User Logins
description: |
  'This query identifies evidence of failed login attempts from a large number of distinct users on a Pulse Connect Secure VPN server'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  let threshold = 100;
  PulseConnectSecure
  | where Messages startswith "Login failed"
  | summarize dcount(User) by Computer, bin(TimeGenerated, 15m)
  | where dcount_User > threshold
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 100;

Stage 1: source

PulseConnectSecure

Stage 2: where

| where Messages startswith "Login failed"

Stage 3: summarize

| summarize dcount(User) by Computer, bin(TimeGenerated, 15m)

Stage 4: where

| where dcount_User > threshold

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Messagesstarts_with
  • Login failed
dcount_Usergt
  • 100 transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
Computersummarize