Syslog Failedlogonattempts Unknownuser
KQL detection rule by ep3p · MIT
No description provided
let query_frequency = 1h;
let query_period = 2h;
let failures_threshold = 5;
let _InfoInvalidUser =
Syslog
| where TimeGenerated > ago(query_period)
| where SyslogMessage has_any ("invalid user") and not(SyslogMessage has "[preauth]") and Facility in ("auth", "authpriv")
| parse SyslogMessage with * "user " User:string " from " RemoteIPAddress:string " port " RemotePort:int *
| summarize hint.strategy=shuffle arg_min(TimeGenerated, *) by HostName, HostIP, ProcessID, RemoteIPAddress, RemotePort
;
let _UserUnknown =
Syslog
| where TimeGenerated > ago(query_period)
| where SyslogMessage has_any ("user unknown") and Facility in ("auth", "authpriv")
| join kind=leftanti _InfoInvalidUser on HostName, ProcessID
;
union _InfoInvalidUser, _UserUnknown
| as _Events
| join kind=leftsemi (
_Events
| evaluate activity_counts_metrics(Type, TimeGenerated, ago(query_period), now(), query_frequency, HostName, HostIP, ProcessName)
| summarize
arg_min(PreviousTimeGenerated = TimeGenerated, PreviousCount = ["count"]),
arg_max(CurrentTimeGenerated = TimeGenerated, CurrentCount = ["count"])
by HostName, HostIP, ProcessName
| where CurrentTimeGenerated > ago(query_period)
| extend PreviousCount = iff(PreviousTimeGenerated == CurrentTimeGenerated, 0, PreviousCount)
| where (not(PreviousCount > failures_threshold) and CurrentCount > failures_threshold)
or ((CurrentCount - PreviousCount) > failures_threshold)
) on HostName, HostIP, ProcessName
| summarize
StartTime = min(TimeGenerated),
EndTime = max(TimeGenerated),
Count = count(),
Facilities = array_sort_asc(make_set(Facility)),
SeverityLevels = array_sort_asc(make_set(SeverityLevel)),
SyslogMessages = make_list(SyslogMessage, 100),
take_any(_ResourceId)
by HostName, HostIP, ProcessName
| project
StartTime,
EndTime,
HostName,
HostIP,
Facilities,
SeverityLevels,
ProcessName,
Count,
SyslogMessages,
_ResourceId