Rare Login Query Not Working

[a2123k1]

Hi team, 
I made a correlation query that looks for logins that haven't been seen on the servers in the last 7 days. This filters all successful login to endpoint type servers.

preset = xdr_login_events 
| join type = inner (dataset=endpoints | fields endpoint_name, endpoint_type) as ep ep.endpoint_name contains agent_hostname
| filter endpoint_type contains "SERVER"
| filter action_user_status = ACTION_LOGIN and outcome = "SUCCESS" and dst_is_machine_account = "false" and action_local_ip not in ("",":1","127.0.0.1") 
| alter identity = login_data_dst_normalized_user -> identity, domain = login_data_dst_normalized_user -> domain 
| fields identity, domain, agent_hostname as dest_host, action_local_ip as source_ip , action*, actor*, *dst*, src*
|comp count() as login_count by identity, domain , dest_host, source_ip addrawdata = true as rawdata
| filter login_count = 1

I find that this query also detects ANY authentication event including network logins (share, mapped drives etc.) and any service logins. Is there a way to filter interactive, and remote logins? There is a method under login_data_dst_normalized_user but I'm guessing that's not the same method as Window's eventID 4624 method, and we have some Linux based machines, so we can't use the event ID to filter them.

[aspatil · Accepted solution]

Hello @a2123k1 ,

​To identify rare administrative login events on servers, specifically distinguishing between interactive and remote logins, it's essential to utilize the xdr_data dataset in Cortex XDR.

You can refer to below sample, but modify as per your requirement.

config timeframe = 30d
| dataset = xdr_data
| filter event_type = ENUM.EVENT_LOG and action_evtlog_event_id = 4624
| alter Logon_Type = arrayindex(regextract(action_evtlog_message, "Logon Type:\s+(\d+)"), 0)
| filter Logon_Type in ("2", "10") // 2: Interactive, 10: RemoteInteractive (e.g., RDP)
| join type = inner (
dataset = endpoints
| fields endpoint_name, endpoint_type
) as ep ep.endpoint_name = agent_hostname
| filter endpoint_type contains "SERVER"
| filter actor_effective_username in ("Administrator", "admin", "root", "svc_admin") // Adjust as per your environment
| alter identity = login_data_dst_normalized_user -> identity,
domain = login_data_dst_normalized_user -> domain
| fields identity, domain, agent_hostname as dest_host, action_local_ip as source_ip, Logon_Type, action_evtlog_message
| comp count() as login_count by identity, domain, dest_host, source_ip, Logon_Type
| filter login_count = 1

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.