Detection rules › Kusto

CTE - Admin Login Detected

Severity
informational
Time window
30m
Source
github.com/Azure/Azure-Sentinel

An administrator logged into the Cybereinforce console.

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Rule body

id: 65bc5f1d-d29d-4729-a5a6-d9614b0900e0
name: CTE - Admin Login Detected
description: |
  An administrator logged into the Cybereinforce console.
severity: Informational
requiredDataConnectors:
  - connectorId: cybereinforce_cte
    dataTypes:
      - CybereinforceCTE_CL
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
  CybereinforceCTE_CL
  | where EventType == "auth.login"
  | extend AccountName = tostring(split(Actor, "@")[0]), UPNSuffix = tostring(split(Actor, "@")[1])
  | project TimeGenerated, TenantId, Actor, AccountName, UPNSuffix, Severity, Category, Source
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: UPNSuffix
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

CybereinforceCTE_CL

Stage 2: where

| where EventType == "auth.login"

Stage 3: extend

| extend AccountName = tostring(split(Actor, "@")[0]), UPNSuffix = tostring(split(Actor, "@")[1])

Stage 4: project

| project TimeGenerated, TenantId, Actor, AccountName, UPNSuffix, Severity, Category, Source

Indicators

These rows show field, operator, and value matches.

Output fields

These fields are emitted when the rule matches.

FieldSource
AccountNameproject
Actorproject
Categoryproject
Severityproject
Sourceproject
TenantIdproject
TimeGeneratedproject
UPNSuffixproject