detection.wiki

Detection rules › Kusto

User Sign in from different countries

Status
available
Severity
medium
Time window
1h
Group by
ClientIp, Dummy, Hour, User
Source
github.com/Azure/Azure-Sentinel

'This query searches for successful user logins from different countries within 30 mins.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Rule body

id: 3094e036-e5ae-4d6e-8626-b0f86ebc71f2
name: User Sign in from different countries
description: |
  'This query searches for successful user logins from different countries within 30 mins.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SalesforceServiceCloudCCPDefinition
    dataTypes:
      - SalesforceServiceCloud
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  let threshold = 2;
  let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)
  [@"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv"];
  let UsersLocation = SalesforceServiceCloud
  | where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'
  | project TimeGenerated, TimestampDerived, ClientIp, UserId, User, UserType ;
  UsersLocation
  | extend Dummy=1
  | extend TimestampDerived = todatetime(TimestampDerived)
  | summarize count() by Hour=bin(TimestampDerived,30m), ClientIp,User, Dummy
  | partition by Hour(
                  lookup (Countrydb|extend Dummy=1) on Dummy
                | where ipv4_is_match(ClientIp, Network)
                )
  | summarize NumOfCountries = dcount(country_name) by User, Hour
  | where NumOfCountries >= threshold
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: User
version: 1.0.4
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 2;

let UsersLocation is inlined into the numbered stages below.

Let binding: Countrydb used in Stage 7

let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)
[@"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv"];

Stages 1 to 3 define let UsersLocation (the rule's main pipeline source); stages 4 to 9 run on it.

Stage 1: source

SalesforceServiceCloud

Stage 2: where

| where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'

Stage 3: project

| project TimeGenerated, TimestampDerived, ClientIp, UserId, User, UserType

Stage 4: extend

UsersLocation
| extend Dummy=1

Stage 5: extend

| extend TimestampDerived = todatetime(TimestampDerived)

Stage 6: summarize

| summarize count() by Hour=bin(TimestampDerived,30m), ClientIp,User, Dummy

Stage 7: partition

| partition by Hour(
                lookup (Countrydb|extend Dummy=1) on Dummy
              | where ipv4_is_match(ClientIp, Network)
              )

Stage 8: summarize

| summarize NumOfCountries = dcount(country_name) by User, Hour

Stage 9: where

| where NumOfCountries >= threshold

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventTypeeq
  • Login
field:"EventType" kind:eq value:"Login"
LoginStatuseq
  • LOGIN_NO_ERROR
field:"LoginStatus" kind:eq value:"LOGIN_NO_ERROR"
NumOfCountriesge
  • 2
field:"NumOfCountries" kind:ge value:"2"

Output fields

These fields are emitted when the rule matches.

FieldSource
Hoursummarize
NumOfCountriessummarize
Usersummarize