Utimaco ESKM - Multiple KMIP authentication failures from same IP

Status: available
Severity: medium
Time window: 15m
Group by: IP
Source: github.com/Azure/Azure-Sentinel

This query searches for 5 or more KMIP "Authentication Failure" events originating from the same client IP within a 15 minute window on Utimaco ESKM. This may indicate brute-force or credential-stuffing activity against the KMIP server.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Rule body

id: 9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a01
name: Utimaco ESKM - Multiple KMIP authentication failures from same IP
description: |
  This query searches for 5 or more KMIP "Authentication Failure" events originating from the same client IP within a 15 minute window on Utimaco ESKM. This may indicate brute-force or credential-stuffing activity against the KMIP server.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: UtimacoESKMConnector
    dataTypes:
      - UtimacoESKMKmipServerLogs_CL
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
query: |
  UtimacoESKMKmipServerLogs_CL
  | where TimeGenerated > ago(15m)
  | where Event == "Authentication Failure"
  | where isnotempty(IP)
  | summarize FailureCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Users = make_set(User, 50) by IP
  | where FailureCount >= 5
  | extend IPCustomEntity = IP
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

UtimacoESKMKmipServerLogs_CL

Stage 2: `where`

| where TimeGenerated > ago(15m)

Stage 3: `where`

| where Event == "Authentication Failure"

Stage 4: `where`

| where isnotempty(IP)

Stage 5: `summarize`

| summarize FailureCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Users = make_set(User, 50) by IP

Stage 6: `where`

| where FailureCount >= 5

Stage 7: `extend`

| extend IPCustomEntity = IP

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Event`	eq	`Authentication Failure`	`field:"Event" kind:eq value:"Authentication Failure"`
`FailureCount`	ge	`5`	`field:"FailureCount" kind:ge value:"5"`
`IP`	is_not_null	(no value, null check)	`field:"IP" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`summarize`
`FailureCount`	`summarize`
`IP`	`summarize`
`StartTime`	`summarize`
`Users`	`summarize`
`IPCustomEntity`	`extend`

Utimaco ESKM - Multiple KMIP authentication failures from same IP

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: summarize

Stage 6: where

Stage 7: extend