Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
This query will determine multiple password resets by user across multiple data sources. Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Standalone Content |
| ID | 0b9ae89d-8cad-461c-808f-0494f70ad5c4 |
| Severity | Low |
| Kind | Scheduled |
| Tactics | InitialAccess, CredentialAccess |
| Techniques | T1078, T1110 |
| Required Connectors | AzureActiveDirectory, SecurityEvents, Syslog, Office365, WindowsSecurityEvents, WindowsForwardedEvents |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AuditLogs |
✓ | ✗ | ? | |
OfficeActivity |
OfficeWorkload == "AzureActiveDirectory" |
✓ | ✗ | ? |
SecurityEvent |
✓ | ✓ | ? | |
Syslog |
Facility in "auth,authpriv"SyslogMessage matchesregex ".*password changed for.*" |
✓ | ✓ | ? |
WindowsEvent |
EventID in "4723,4724" |
✓ | ✓ | ? |
The following connectors provide data for this content item:
Solutions: Cisco SD-WAN, CiscoMeraki, Forescout (Legacy), Microsoft Entra ID, Microsoft Exchange Security - Exchange On-Premises, Windows Forwarded Events, Windows Security Events
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊