Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)

Severity: medium
Time window: 1d
Group by: SrcDvcIpAddr, Type
Source: github.com/Azure/Azure-Sentinel

Identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account. To use this analytics rule, make sure you have deployed the ASIM normalization parsers

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts `T1098` Account Manipulation

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.
Security-Auditing	Event ID 4625: An account failed to log on.
Security-Auditing	Event ID 4634: An account was logged off.

Rule body

id: 95002681-4ecb-4da3-9ece-26d7e5feaa33
name: Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)
description: |
  'Identifies IPs with failed attempts to sign in to one or more disabled accounts signed in successfully to another account.
  To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimAuthentication)'
severity: Medium
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
relevantTechniques:
  - T1078
  - T1098
tags:
  - Id: 500c103a-0319-4d56-8e99-3cec8d860757
    version: 1.0.0
query: |
  imAuthentication
  | where EventResult =='Failure'
  | where EventResultDetails == 'User disabled'
  | summarize StartTime=min(EventStartTime), EndTime=max(EventEndTime), disabledAccountLoginAttempts = count()
        , disabledAccountsTargeted = dcount(TargetUsername), disabledAccountSet = make_set(TargetUsername)
        , applicationsTargeted = dcount(TargetAppName)
        , applicationSet = make_set(TargetAppName) 
        by SrcDvcIpAddr, Type
  | order by disabledAccountLoginAttempts desc
  | join kind=leftouter 
      (
      // Consider these IPs suspicious - and alert any related  successful sign-ins
      imAuthentication
      | where EventResult=='Success'
      | summarize successfulAccountSigninCount = dcount(TargetUsername), successfulAccountSigninSet = makeset(TargetUsername, 15) by SrcDvcIpAddr, Type
      // Assume IPs associated with sign-ins from 100+ distinct user accounts are safe
      | where successfulAccountSigninCount < 100
      )
      on SrcDvcIpAddr
  | where isnotempty(successfulAccountSigninCount)
  | project StartTime, EndTime, SrcDvcIpAddr, disabledAccountLoginAttempts, disabledAccountsTargeted, disabledAccountSet, applicationSet, 
  successfulAccountSigninCount, successfulAccountSigninSet, Type
  | order by disabledAccountLoginAttempts
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcDvcIpAddr
version: 1.0.3
kind: Scheduled
metadata:
  source:
    kind: Community

Stages and Predicates

Stage 1: `source`

imAuthentication

Stage 2: `where`

| where EventResult =='Failure'

Stage 3: `where`

| where EventResultDetails == 'User disabled'

Stage 4: `summarize`

| summarize StartTime=min(EventStartTime), EndTime=max(EventEndTime), disabledAccountLoginAttempts = count()
      , disabledAccountsTargeted = dcount(TargetUsername), disabledAccountSet = make_set(TargetUsername)
      , applicationsTargeted = dcount(TargetAppName)
      , applicationSet = make_set(TargetAppName) 
      by SrcDvcIpAddr, Type

Stage 5: `sort`

| order by disabledAccountLoginAttempts desc

Stage 6: `join`

| join kind=leftouter 
    (
    imAuthentication
    | where EventResult=='Success'
    | summarize successfulAccountSigninCount = dcount(TargetUsername), successfulAccountSigninSet = makeset(TargetUsername, 15) by SrcDvcIpAddr, Type
    | where successfulAccountSigninCount < 100
    )
    on SrcDvcIpAddr

Stage 7: `where`

| where isnotempty(successfulAccountSigninCount)

Stage 8: `project`

| project StartTime, EndTime, SrcDvcIpAddr, disabledAccountLoginAttempts, disabledAccountsTargeted, disabledAccountSet, applicationSet, 
successfulAccountSigninCount, successfulAccountSigninSet, Type

Stage 9: `sort`

| order by disabledAccountLoginAttempts

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventResult`	eq	`Failure` corpus 2 (kusto 2) `Success` corpus 2 (kusto 2)	`field:"EventResult" kind:eq`
`EventResultDetails`	eq	`User disabled`	`field:"Status" kind:eq value:"User disabled"`
`successfulAccountSigninCount`	is_not_null	(no value, null check)	`field:"successfulAccountSigninCount" kind:is_not_null`
`successfulAccountSigninCount`	lt	`100` corpus 2 (kusto 2)	`field:"successfulAccountSigninCount" kind:lt value:"100"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`project`
`SrcDvcIpAddr`	`project`
`StartTime`	`project`
`Type`	`project`
`applicationSet`	`project`
`disabledAccountLoginAttempts`	`project`
`disabledAccountSet`	`project`
`disabledAccountsTargeted`	`project`
`successfulAccountSigninCount`	`project`
`successfulAccountSigninSet`	`project`

Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization)

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: sort

Stage 6: join

Stage 7: where

Stage 8: project

Stage 9: sort