Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
This query will determine multiple password resets by user across multiple data sources. Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | 0b9ae89d-8cad-461c-808f-0494f70ad5c4 |
| Severity | Low |
| Kind | Scheduled |
| Tactics | InitialAccess, CredentialAccess |
| Techniques | T1078, T1110 |
| Required Connectors | AzureActiveDirectory, SecurityEvents, Syslog, Office365, WindowsSecurityEvents, WindowsForwardedEvents |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AuditLogs |
✓ | ✗ | ✓ | |
OfficeActivity |
OfficeWorkload == "AzureActiveDirectory" |
✓ | ✗ | ✓ |
SecurityEvent |
✓ | ✓ | ✓ | |
Syslog |
Facility in "auth,authpriv"SyslogMessage matchesregex ".*password changed for.*" |
✓ | ✓ | ✓ |
WindowsEvent |
EventID in "4723,4724" |
✓ | ✓ | ✓ |
The following connectors provide data for this content item:
Solutions: Cisco SD-WAN, Cisco UCS (legacy connector), Citrix ADC (legacy connector), Forescout (Legacy), Microsoft Entra ID, Microsoft Exchange Security - Exchange On-Premises, RSA SecurID (legacy connector), Watchguard Firebox (legacy connector), Windows Forwarded Events, Windows Security Events
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊