Failed host logons but success logon to AzureAD

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Identifies a list of IP addresses with a minimum number(default of 5) of failed logon attempts to remote hosts. Uses that list to identify any successful logons to Microsoft Entra ID from these IPs within the same timeframe.

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	`1ce5e766-26ab-4616-b7c8-3b33ae321e80`
Severity	Medium
Kind	Scheduled
Tactics	InitialAccess, CredentialAccess
Techniques	T1078, T1110
Required Connectors	AzureActiveDirectory, AzureActiveDirectory, SecurityEvents, Syslog, WindowsSecurityEvents, WindowsForwardedEvents
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
`SecurityEvent`		✓	✓	?
`Syslog`	`Facility contains "auth"` `ProcessName != "sudo"` `SyslogMessage has "from"` `SyslogMessage has_any "Accepted,Disconnected,Disconnecting,[preauth],disconnect"`	✓	✓	?
`WindowsEvent`	`EventID == "4625"`	✓	✓	?

Associated Connectors

The following connectors provide data for this content item:

Connector	Solution
CiscoMeraki(usingRESTAPI)	CiscoMeraki
CiscoMerakiNativePoller	CiscoMeraki
CiscoSDWAN	Cisco SD-WAN
ESI-Opt34DomainControllersSecurityEventLogs	Microsoft Exchange Security - Exchange On-Premises
Forescout	Forescout (Legacy)
SecurityEvents	Windows Security Events
WindowsForwardedEvents	Windows Forwarded Events
WindowsSecurityEvents	Windows Security Events

Solutions: Cisco SD-WAN, CiscoMeraki, Forescout (Legacy), Microsoft Exchange Security - Exchange On-Premises, Windows Forwarded Events, Windows Security Events

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules