NordPass - User fails authentication

Severity: high
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

This will alert you if a user fails to log in to their NordPass account or SSO authentication three or more times in the last 24 hours.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force `T1556.003` Modify Authentication Process: Pluggable Authentication Modules

Rule body

id: 27b261dc-68f3-489a-944f-bc252e0c1960
name: NordPass - User fails authentication
kind: Scheduled
version: 1.0.0
displayName: User fails authentication
description: |
  This will alert you if a user fails to log in to their NordPass account or SSO authentication three or more times in the last 24 hours.
severity: High
query: |
  let threshold = 2;
  let filteredData = materialize(
      NordPassEventLogs_CL
      | where event_type == "login" and action == "user_login_failed"
  );
  let users = filteredData
      | summarize Count = count() by user_email
      | where Count > threshold
      | project user_email;
  filteredData  
  | where user_email in (users)
  | extend TargetEmail = user_email, IPAddress = metadata.ip_address, Provider = metadata.provider
requiredDataConnectors:
  - connectorId: NordPass
    dataTypes:
      - NordPassEventLogs_CL
queryFrequency: 5m
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 2
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110
  - T1556.003
customDetails:
  Provider: Provider
incidentConfiguration:
  createIncident: false
entityMappings:
  - entityType: Mailbox
    fieldMappings:
      - identifier: MailboxPrimaryAddress
        columnName: TargetEmail
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress

Stages and Predicates

Parameters

let threshold = 2;

let filteredData is inlined into the numbered stages below.

Let binding: `users` used in Stage 3

let users = filteredData
    | summarize Count = count() by user_email
    | where Count > threshold
    | project user_email;

Stages 1 to 2 define let filteredData (the rule's main pipeline source); stages 3 to 4 run on it.

Stage 1: `source`

NordPassEventLogs_CL

Stage 2: `where`

| where event_type == "login" and action == "user_login_failed"

Stage 3: `where`

filteredData
| where user_email in (users)

Stage 4: `extend`

| extend TargetEmail = user_email, IPAddress = metadata.ip_address, Provider = metadata.provider

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`user_login_failed`	`field:"action" kind:eq value:"user_login_failed"`
`event_type`	eq	`login`	`field:"event_type" kind:eq value:"login"`
`user_email`	in	`users`	`field:"user_email" kind:in value:"users"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`IPAddress`	`extend`
`Provider`	`extend`
`TargetEmail`	`extend`