Authentication From Suspicious DeviceName

KQL Queries

Using KQL (Kusto Query Language) query to identify suspicious authentication attempts originating from unusual or suspicious workstation names. This query assumes you're working with Azure Monitor, Sentinel, or a similar platform that supports KQL and logs such as SecurityEvent, SigninLogs, or other authentication-related logs.

SecurityEvent

Using KQL (Kusto Query Language) query to identify suspicious authentication attempts originating from unusual or suspicious workstation names. This query assumes you're working with Azure Monitor, Sentinel, or a similar platform that supports KQL and logs such as SecurityEvent, SigninLogs, or other authentication-related logs.

// Define a list of known suspicious workstation patterns
let SuspiciousWorkstations = dynamic(["UNKNOWN", "TEMP", "WORKSTATION-", "DESKTOP-"]);
// Query authentication logs
SecurityEvent
| where EventID in (4624, 4625)  // Filter for logon success (4624) or failure (4625) events
| extend WorkstationName = iff(isnotempty(Workstation), Workstation, Computer) // Extract workstation/computer name
| where WorkstationName has_any (SuspiciousWorkstations) 
      or WorkstationName matches regex @"^(TEMP|DESKTOP|UNKNOWN|WORKSTATION-).*$"  // Match dynamic list or regex patterns
| summarize
    LogonAttempts = count(),
    UniqueUserCount = dcount(TargetUserName),
    FailedAttempts = countif(EventID == 4625)
    by WorkstationName, TargetUserName, LogonType, bin(TimeGenerated, 1h)
| extend LogonTypeDescription = case(
    LogonType == 2, "Interactive",
    LogonType == 3, "Network",
    LogonType == 10, "Remote Interactive",
    LogonType == 7, "Unlock",
    LogonType == 5, "Service",
    LogonType == 4, "Batch",
    "Unknown"
)
| order by LogonAttempts desc
| project TimeGenerated, WorkstationName, TargetUserName, LogonTypeDescription, LogonAttempts, FailedAttempts, UniqueUserCount

Key Details:

1. Dynamic List of Suspicious Names: Adjust SuspiciousWorkstations to include prefixes, patterns, or specific workstation names you consider suspicious.

2. Event IDs: Targets Windows Security Event IDs for logon success (4624) and failure (4625).

3. Regex Matching: Matches patterns using a regex for flexible detection of workstation naming conventions.

4. Summarization: Group data by workstation name, user, and logon type for better analysis and filtering.

5. Logon Type Mapping: Provides a human-readable description of the logon type for better context.

Results:

• WorkstationName: The suspicious workstation name.

• TargetUserName: User attempting to log in.

• LogonTypeDescription: Describes how the logon was attempted (e.g., Interactive, Network, Remote Interactive).

• LogonAttempts: Total authentication attempts.

• FailedAttempts: Count of failed logon attempts.

You may have to tweak the query to include additional suspicious patterns or integrate it with threat intelligence feeds for enhanced correlation.

DeviceLogonEvents

IdentityLogonEvents

SigninLogs

Splunk Query:

Wineventlog

Using Splunk query to discover authentication events originating from suspicious workstation names. This query assumes you're using Windows Event Logs (index=wineventlog) or a similar data source for authentication events.

Note: The fields in your Splunk logs may differ slightly; for example, AccountName may be displayed as Account_Name.

index=wineventlog EventCode IN (4624, 4625) 
| eval WorkstationName=coalesce(Workstation, ComputerName)  // Normalize workstation field names
| search WorkstationName IN ("TEMP*", "DESKTOP-*", "UNKNOWN", "WORKSTATION-*")  // Match known suspicious patterns
| eval Suspicious = if(match(WorkstationName, "^(TEMP|DESKTOP|UNKNOWN|WORKSTATION-).*$"), "Yes", "No")
| stats count AS TotalAttempts, 
        count(eval(EventCode=4625)) AS FailedAttempts, 
        dc(UserName) AS UniqueUsers 
        by WorkstationName, UserName, LogonType, Suspicious
| eval LogonTypeDescription=case(
        LogonType=="2", "Interactive",
        LogonType=="3", "Network",
        LogonType=="10", "Remote Interactive",
        LogonType=="7", "Unlock",
        LogonType=="5", "Service",
        LogonType=="4", "Batch",
        true(), "Unknown"
    )
| where Suspicious="Yes" 
| sort - TotalAttempts
| table WorkstationName, UserName, LogonTypeDescription, TotalAttempts, FailedAttempts, UniqueUsers

Key Details:

1. EventCode Filtering:

   • 4624: Logon success.

   • 4625: Logon failure.

2. Normalization:

   • Uses coalesce() to handle scenarios where either Workstation or ComputerName maybe populated.

3. Suspicious Workstation Patterns:

   • Matches common suspicious workstation naming conventions like TEMP*, DESKTOP-*, UNKNOWN, or WORKSTATION-*.

   • Regex patterns used in match() provide flexibility.

4. Stats Aggregation:

   • Aggregates data to summarise:

     • TotalAttempts: Total authentication attempts.

     • FailedAttempts: Failed login attempts.

     • UniqueUsers: Unique users attempting to log in from suspicious workstations.

5. Logon Type Description:

   • Maps LogonType values to human-readable descriptions for better context.

6. Filtering and Sorting:

   • Displays results only for suspicious workstations (where Suspicious="Yes").

   • Sorts results by the highest number of total attempts.

7. Output:

   • Displays key fields like WorkstationName, UserName, LogonTypeDescription, and summarised stats.

Customisation:

• Suspicious Patterns: Adjust the search clause or match() function to include additional patterns or specific workstation names based on your organisation's threat models.

• Additional Fields: Extend the query with fields like SourceIP or DestinationIP for more in-depth analysis.

• Enrichment: Integrate with threat intelligence feeds to correlate suspicious workstation names or IPs.

Authlogs