하나의 대역에서 다수 계정에 대한 접속을 시도하는 공격을 탐지합니다.
Overview
| Priority | High |
|---|---|
| Type | Batch |
| Schedule | Every month/Every day/Every hour/At 0 min 0 * * * * |
| Message | VPN 동일 대역 다수 계정 인증 실패: $band (계정 $account_cnt개 / $total회) |
| Output field order | band, account_cnt, total, _time, account, src_ip, src_country, description, line |
| MITRE Techniques | T1110 |
| MITRE tactics | TA0006 Credential Access |
| Origin | User proposal |
Query
1table from=$("from") to=$("to") *:FW_PALOALTO
2| search _schema == "paloalto-ngfw-system" and event_id == "auth-fail"
3| rex field=description "for user '(?<account>[^']+)'"
4| rex field=description "From: (?<src_ip_str>\d+\.\d+\.\d+\.\d+)"
5| eval band = network(src_ip_str, 24)
6| stats count as total, dc(account) as account_cnt by band
7| search account_cnt >= 20
8| sort -total
9| join type=left band [
10 table from=$("from") to=$("to") *:FW_PALOALTO
11 | search _schema == "paloalto-ngfw-system" and event_id == "auth-fail"
12 | rex field=description "for user '(?<account>[^']+)'"
13 | rex field=description "From: (?<src_ip_str>\d+\.\d+\.\d+\.\d+)"
14 | eval band = network(src_ip_str, 24), src_ip = ip(src_ip_str)
15 | lookup geoip src_ip output country as src_country
16]
17| order band, account_cnt, total, _time, account, src_ip, src_country, description, line