Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to Microsoft Entra ID. Uses that list to identify any successful remote logons to hosts from these IPs within the same timeframe.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | 8ee967a2-a645-4832-85f4-72b635bcb3a6 |
| Severity | Medium |
| Kind | Scheduled |
| Tactics | InitialAccess, CredentialAccess |
| Techniques | T1078, T1110 |
| Required Connectors | AzureActiveDirectory, AzureActiveDirectory, SecurityEvents, Syslog, WindowsSecurityEvents, WindowsForwardedEvents |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
SecurityEvent |
✓ | ✓ | ✓ | |
Syslog |
Facility contains "auth"ProcessName != "sudo"SyslogMessage has "Accepted" |
✓ | ✓ | ✓ |
WindowsEvent |
✓ | ✓ | ✓ |
The following connectors provide data for this content item:
Solutions: Cisco SD-WAN, Cisco UCS (legacy connector), Citrix ADC (legacy connector), Forescout (Legacy), Microsoft Exchange Security - Exchange On-Premises, RSA SecurID (legacy connector), Watchguard Firebox (legacy connector), Windows Forwarded Events, Windows Security Events
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊