↳ Source GitHubRègle analytiqueHigh
StealthTalk - Password brute force
Description
Identifies a brute-force authentication attempt against a single StealthTalk user account. The StealthTalk anti-brute-force subsystem emits a `MultiFailLogin` event when consecutive failed attempts trigger an automatic account lockout. This rule fires when the reported number of consecutive failures is 9 or more, distinguishing a credential-guessing attack from an isolated user error. The lockout duration (`LoginBlockingSeconds`) is surfaced as a custom detail so the SOC analyst can prioritise by attack persistence.
- Type de règle
- Scheduled
- Version
- 1.0.0
- Statut déclaré
- Available
- Fréquence
- 15m
- Période analysée
- 5h
- Déclenchement
- gt 0
Couverture MITRE déclarée
Sources déclarées
Métadonnées du fichier source. Aucune dépendance déduite du KQL.
Connecteurs
Types de données
Requête KQL
Requête originale, sans modification.
let LookbackPeriod = 5h;
let MinFailedAttempts = 9;
StealthTalkAnomalousAuth_CL
| where TimeGenerated >= ago(LookbackPeriod)
| where EventType == "MultiFailLogin"
| where PassedAttempts >= MinFailedAttempts
| extend
BlockingMinutes = LoginBlockingSeconds / 60,
AlertName = "PasswordBruteForce",
AlertDetails = strcat(
"User ", UserId,
" had ", PassedAttempts, " consecutive failed login attempts",
" on device ", DeviceId, ".",
" Account blocked for ", LoginBlockingSeconds, " seconds",
" (", LoginBlockingSeconds / 60, " min)."
)
| project
TimeGenerated, UserId, DeviceId,
PassedAttempts, LoginBlockingSeconds, BlockingMinutes,
AppVersion, RawEventId, AlertName, AlertDetails
Entités déclarées
Contenus associés
Liens établis à partir des identifiants déclarés et des manifests des solutions.
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
629d1d3↗- Identifiant source
b8e5f3a2-9c4d-4d1f-8a7b-3c2d1e0f9a8b
GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC