Brute force attack against user credentials

Status: available
Severity: medium
Time window: 1h
Group by: User, UserId, UserType
Source: github.com/Azure/Azure-Sentinel

'Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses. The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Rule body

id: 5a6ce089-e756-40fb-b022-c8e8864a973a
name: Brute force attack against user credentials
description: |
  'Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses.
  The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SalesforceServiceCloudCCPDefinition
    dataTypes:
      - SalesforceServiceCloud
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  let failureCountThreshold = 10;
  let successCountThreshold = 1;
  let Failures =
  SalesforceServiceCloud
  | where EventType == "Login" and LoginStatus != "LOGIN_NO_ERROR"
  | summarize
        FailureStartTime = min(TimeGenerated),
        FailureEndTime = max(TimeGenerated),
        IpAddresses = make_set (ClientIp, 100),
        FailureCount = count() by User, UserId, UserType;
    SalesforceServiceCloud
    | where EventType == "Login" and LoginStatus == "LOGIN_NO_ERROR"
    | summarize
            SuccessStartTime = min(TimeGenerated),
            SuccessEndTime = max(TimeGenerated),
            IpAddresses = make_set (ClientIp, 100),
            SuccessCount = count() by User, UserId, UserType
    | join kind=leftouter Failures on UserId
    | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold
    | where FailureEndTime < SuccessStartTime
    | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses
customDetails:
  EventStartTime: FailureStartTime
  EventEndTime: SuccessEndTime
  IPAddresses: IpAddresses
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let failureCountThreshold = 10;
let successCountThreshold = 1;

Let binding: `Failures` used in Stage 4

let Failures = SalesforceServiceCloud
| where EventType == "Login" and LoginStatus != "LOGIN_NO_ERROR"
| summarize
      FailureStartTime = min(TimeGenerated),
      FailureEndTime = max(TimeGenerated),
      IpAddresses = make_set (ClientIp, 100),
      FailureCount = count() by User, UserId, UserType;

Stage 1: `source`

SalesforceServiceCloud

Stage 2: `where`

| where EventType == "Login" and LoginStatus == "LOGIN_NO_ERROR"

Stage 3: `summarize`

| summarize
          SuccessStartTime = min(TimeGenerated),
          SuccessEndTime = max(TimeGenerated),
          IpAddresses = make_set (ClientIp, 100),
          SuccessCount = count() by User, UserId, UserType

Stage 4: `join`

| join kind=leftouter Failures on UserId

Stage 5: `where`

| where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold

Stage 6: `where`

| where FailureEndTime < SuccessStartTime

Stage 7: `project`

| project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	eq	`Login`	`field:"EventType" kind:eq value:"Login"`
`FailureCount`	ge	`10`	`field:"FailureCount" kind:ge value:"10"`
`FailureEndTime`	cross_field_compare	`SuccessStartTime` transforms: `op:lt`	`field:"FailureEndTime" kind:cross_field_compare value:"SuccessStartTime"`
`LoginStatus`	eq	`LOGIN_NO_ERROR`	`field:"LoginStatus" kind:eq value:"LOGIN_NO_ERROR"`
`LoginStatus`	ne	`LOGIN_NO_ERROR`	`field:"LoginStatus" kind:ne value:"LOGIN_NO_ERROR"`
`SuccessCount`	ge	`1`	`field:"SuccessCount" kind:ge value:"1"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EventEndTime`	`project`
`EventStartTime`	`project`
`IpAddresses`	`project`
`User`	`project`

Brute force attack against user credentials

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: Failures used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: join

Stage 5: where

Stage 6: where

Stage 7: project