Detection rules › Kusto
Successful logins to SOC Prime platform from bad IP addresses
'This rule identifies successful logins from IP addresses previously flagged as malicious (e.g., botnets, TOR exit nodes, or known malicious IPs)'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts |
Rule body kusto
id: f8e7d6c5-b4a3-4122-8110-0987654321fe
name: Successful logins to SOC Prime platform from bad IP addresses
description: |
'This rule identifies successful logins from IP addresses previously flagged as malicious (e.g., botnets, TOR exit nodes, or known malicious IPs)'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: SOCPrimeAuditLogsDataConnector
dataTypes:
- SOCPrimeAuditLogs_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1078
query: |
let blacklistIPs = _GetWatchlist('blacklistOfIps')
| project IPAddress = column_ifexists('ip','IPAddress');
SOCPrimeAuditLogs_CL
| where EventName == "Logged in to the SOC Prime Platform"
| where SourceIp in (blacklistIPs)
| project TimeGenerated, EventName, UserEmail, UserName, SourceIp, Uri, Type
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: UserName
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIp
version: 1.0.0
kind: Scheduled
Stages and Predicates
Let binding: blacklistIPs
let blacklistIPs = _GetWatchlist('blacklistOfIps')
| project IPAddress = column_ifexists('ip','IPAddress');
Stage 1: source
SOCPrimeAuditLogs_CL
Stage 2: where
| where EventName == "Logged in to the SOC Prime Platform"
Stage 3: where
| where SourceIp in (blacklistIPs)
References blacklistIPs (defined above).
Stage 4: project
| project TimeGenerated, EventName, UserEmail, UserName, SourceIp, Uri, Type
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
EventName | project |
SourceIp | project |
TimeGenerated | project |
Type | project |
Uri | project |
UserEmail | project |
UserName | project |