Detection rules › Kusto
Utimaco ESKM - PERMISSION_DENIED burst for a KMIP user
Identifies a single KMIP user receiving 10 or more PERMISSION_DENIED responses within 30 minutes on Utimaco ESKM. May indicate privilege probing, key access reconnaissance, or a misconfigured application.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Rule body
id: 9b1a3b3e-7e16-4a3b-8a8f-7f1f2b1c0a02
name: Utimaco ESKM - PERMISSION_DENIED burst for a KMIP user
description: |
Identifies a single KMIP user receiving 10 or more PERMISSION_DENIED responses within 30 minutes on Utimaco ESKM. May indicate privilege probing, key access reconnaissance, or a misconfigured application.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: UtimacoESKMConnector
dataTypes:
- UtimacoESKMKmipServerLogs_CL
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
relevantTechniques:
- T1087
query: |
UtimacoESKMKmipServerLogs_CL
| where TimeGenerated > ago(30m)
| where Reason == "PERMISSION_DENIED"
| where isnotempty(User)
| summarize DeniedCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_set(Operation, 50), ObjectTypes = make_set(ObjectType, 25), SourceIPs = make_set(IP, 25) by User
| where DeniedCount >= 10
| extend AccountCustomEntity = User
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
UtimacoESKMKmipServerLogs_CL
Stage 2: where
| where TimeGenerated > ago(30m)
Stage 3: where
| where Reason == "PERMISSION_DENIED"
Stage 4: where
| where isnotempty(User)
Stage 5: summarize
| summarize DeniedCount = count(), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Operations = make_set(Operation, 50), ObjectTypes = make_set(ObjectType, 25), SourceIPs = make_set(IP, 25) by User
Stage 6: where
| where DeniedCount >= 10
Stage 7: extend
| extend AccountCustomEntity = User
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DeniedCount | ge |
| field:"DeniedCount" kind:ge value:"10" |
Reason | eq |
| field:"Reason" kind:eq value:"PERMISSION_DENIED" |
User | is_not_null | field:"user" kind:is_not_null |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
DeniedCount | summarize |
EndTime | summarize |
ObjectTypes | summarize |
Operations | summarize |
SourceIPs | summarize |
StartTime | summarize |
User | summarize |
AccountCustomEntity | extend |