Detection rules › Kusto
CTE - Admin Login Detected
An administrator logged into the Cybereinforce console.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 65bc5f1d-d29d-4729-a5a6-d9614b0900e0
name: CTE - Admin Login Detected
description: |
An administrator logged into the Cybereinforce console.
severity: Informational
requiredDataConnectors:
- connectorId: cybereinforce_cte
dataTypes:
- CybereinforceCTE_CL
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1078
query: |
CybereinforceCTE_CL
| where EventType == "auth.login"
| extend AccountName = tostring(split(Actor, "@")[0]), UPNSuffix = tostring(split(Actor, "@")[1])
| project TimeGenerated, TenantId, Actor, AccountName, UPNSuffix, Severity, Category, Source
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountName
- identifier: UPNSuffix
columnName: UPNSuffix
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
CybereinforceCTE_CL
Stage 2: where
| where EventType == "auth.login"
Stage 3: extend
| extend AccountName = tostring(split(Actor, "@")[0]), UPNSuffix = tostring(split(Actor, "@")[1])
Stage 4: project
| project TimeGenerated, TenantId, Actor, AccountName, UPNSuffix, Severity, Category, Source
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventType | eq |
| field:"EventType" kind:eq value:"auth.login" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
AccountName | project |
Actor | project |
Category | project |
Severity | project |
Source | project |
TenantId | project |
TimeGenerated | project |
UPNSuffix | project |