Potential Password Spray Attack (Uses Authentication Normalization)

Severity: medium
Time window: 5m
Group by: SrcDvcIpAddr, SrcGeoCountry
Author: Ofer Shezaf
Source: github.com/Azure/Azure-Sentinel

This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack To use this analytics rule, make sure you have deployed the ASIM normalization parsers

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.
Security-Auditing	Event ID 4625: An account failed to log on.
Security-Auditing	Event ID 4634: An account was logged off.

Rule body

id: 6a2e2ff4-5568-475e-bef2-b95f12b9367b
name: Potential Password Spray Attack (Uses Authentication Normalization)
description: |
  'This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack
   To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
severity: Medium
requiredDataConnectors: []
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess 
relevantTechniques:
  - T1110
tags:
  - Id: e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508
    version: 1.0.0
  - Schema: ASIMAuthentication
    SchemaVersion: 0.1.0
query: |
  let FailureThreshold = 15;
  imAuthentication
  | where EventType== 'Logon' and  EventResult== 'Failure'
  // reason: creds 
  | where EventResultDetails in ('No such user or password', 'Incorrect password')
  | summarize UserCount=dcount(TargetUserId), Vendors=make_set(EventVendor), Products=make_set(EventVendor)
    , Users = make_set(TargetUserId,100) 
      by SrcDvcIpAddr, SrcGeoCountry, bin(TimeGenerated, 5m)
  | where UserCount > FailureThreshold
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcDvcIpAddr
version: 1.1.3
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Ofer Shezaf
    support:
        tier: Community
    categories:
        domains: [ "Security - Others", "Identity" ]

Stages and Predicates

Parameters

let FailureThreshold = 15;

Stage 1: `source`

imAuthentication

Stage 2: `where`

| where EventType== 'Logon' and  EventResult== 'Failure'

Stage 3: `where`

| where EventResultDetails in ('No such user or password', 'Incorrect password')

Stage 4: `summarize`

| summarize UserCount=dcount(TargetUserId), Vendors=make_set(EventVendor), Products=make_set(EventVendor)
  , Users = make_set(TargetUserId,100) 
    by SrcDvcIpAddr, SrcGeoCountry, bin(TimeGenerated, 5m)

Stage 5: `where`

| where UserCount > FailureThreshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventResult`	eq	`Failure` corpus 2 (kusto 2)	`field:"EventResult" kind:eq value:"Failure"`
`EventResultDetails`	in	`Incorrect password` `No such user or password`	`field:"Status" kind:in`
`EventType`	eq	`Logon` corpus 2 (kusto 2)	`field:"ElevatedToken" kind:eq value:"Logon"`
`UserCount`	gt	`15` corpus 2 (kusto 2)	`field:"UserCount" kind:gt value:"15"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Products`	`summarize`
`SrcDvcIpAddr`	`summarize`
`SrcGeoCountry`	`summarize`
`UserCount`	`summarize`
`Users`	`summarize`
`Vendors`	`summarize`