Anomalies Suspicious Volume Of Logins To Computer
Query
Anomalies
| where RuleName endswith "Suspicious volume of logins to computer" and RuleStatus != "Flighting"
| extend
Query = ExtendedLinks[0]["DetailBladeInputs"],
Computer = Entities[0]["HostName"],
LoginCount = toint(AnomalyDetails["Observables"][0]["Value"]),
ExpectedLoginCount = toint(AnomalyDetails["Observables"][0]["TypicalObservations"]["Expected count"])
| project
TimeGenerated,
RuleName,
Description,
Query,
Computer,
LoginCount,
ExpectedLoginCount,
Score,
AnomalyDetails,
Entities,
Tactics,
Techniques,
ExtendedLinksExplanation
This query is looking for anomalies where the rule name ends with "Suspicious volume of logins to computer" and the rule status is not "Flighting". It then extends the query to include additional information such as the query details, computer hostname, login count, and expected login count. Finally, it projects various fields including time generated, rule name, description, query, computer, login count, expected login count, score, anomaly details, entities, tactics, techniques, and extended links.
Details
Jose Sebastián Canós
Released: December 15, 2022
Tables
Anomalies
Keywords
AnomaliesRuleNameRuleStatusFlightingQueryExtendedLinksComputerEntitiesHostNameLoginCountAnomalyDetailsObservablesValueTypicalObservationsExpected countTimeGeneratedDescriptionScoreTacticsTechniques
Operators
whereendswith!=extendtointproject