Rule is tiggering alert for every event

[agauttam]

The rule triggers alerts for every single matching event because the first cache block has minCount: 1, causing it to save the IP even on isolated events. This leads the second condition to frequently match if 5 similar events from that IP occurred in the past 4 minutes, resulting in constant alerts

UTM
Version 10.7.2

Rule version v1.0.2

• name: "Windows: Multiple Windows logon failures"
  severity: "Medium"
  description: "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained."
  solution: "Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed.
  Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services."
  category: "Potentially Malicious Activity"
  tactic: "Brute Force"
  dataTypes: ["wineventlog"]
  reference:
  • "https://attack.mitre.org/techniques/T1110/"
    frequency: 60
    cache:
  • allOf:
    • field: "logx.wineventlog.event_id"
      operator: "in"
      value: 18456,201,203,204,4771,304,305,306,20187,20014,20078,20050,20049,20189,644,4740
      timeLapse: 60
      minCount: 1
      save:
    • field: "logx.wineventlog.host.ip.1"
      alias: "IPAddress"
  • allOf:
    • field: "logx.wineventlog.host.ip.1"
      operator: "=="
      value: "{{.IPAddress}}"
    • field: "logx.wineventlog.event_id"
      operator: "in"
      value: 18456,201,203,204,4771,304,305,306,20187,20014,20078,20050,20049,20189,644,4740
      timeLapse: 240
      minCount: 5
      save:
    • field: "logx.wineventlog.event_data.SubjectUserName"
      alias: "SourceUser"
    • field: "logx.wineventlog.host.name"
      alias: "DestinationHost"
    • field: "logx.wineventlog.event_data.IpAddress"
      alias: "DestinationIP"
    • field: "logx.wineventlog.event_data.IpPort"
      alias: "DestinationPort"
    • field: "logx.wineventlog.event_data.TargetUserName"
      alias: "DestinationUser"

Regards,
Arun

[rvald26]

Hi!, thank youf ro reporting this. Having our engineer take a look now. Sorry for the delay.

[RathHunt]

Hello, this rule has been updated recently, could you confirm if the issue persists in the latest version?

[agauttam]

Hi,
Just for a single rule, I would prefer not to take the risk of upgrading the entire system. It would be helpful if you could let me know what specific changes are needed for that rule.