40 строки
1.2 KiB
YAML
40 строки
1.2 KiB
YAML
id: 472b7cf4-bf1a-4061-b9ab-9fe4894e3c17
|
|
name: Alsid Password issues
|
|
description: |
|
|
'Searches for triggered Indicators of Exposures related to password issues'
|
|
severity: Low
|
|
requiredDataConnectors:
|
|
- connectorId: AlsidForAD
|
|
dataTypes:
|
|
- AlsidForADLog_CL
|
|
queryFrequency: 2h
|
|
queryPeriod: 2h
|
|
triggerOperator: gt
|
|
triggerThreshold: 0
|
|
status: Available
|
|
tactics:
|
|
- CredentialAccess
|
|
relevantTechniques:
|
|
- T1110
|
|
query: |
|
|
let SeverityTable=datatable(Severity:string,Level:int) [
|
|
"low", 1,
|
|
"medium", 2,
|
|
"high", 3,
|
|
"critical", 4
|
|
];
|
|
let codeNameList = datatable(Codename:string)["C-CLEARTEXT-PASSWORD", "C-PASSWORD-DONT-EXPIRE", "C-USER-REVER-PWDS", "C-PASSWORD-POLICY", "C-USER-PASSWORD", "C-KRBTGT-PASSWORD", "C-AAD-SSO-PASSWORD", "C-REVER-PWD-GPO"];
|
|
afad_parser
|
|
| where MessageType == 0 and Codename in~ (codeNameList)
|
|
| lookup kind=leftouter SeverityTable on Severity
|
|
| order by Level
|
|
| extend HostName = tostring(split(Host, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))
|
|
entityMappings:
|
|
- entityType: Host
|
|
fieldMappings:
|
|
- identifier: HostName
|
|
columnName: HostName
|
|
- identifier: DnsDomain
|
|
columnName: DnsDomain
|
|
version: 1.0.1
|
|
kind: Scheduled |