# Sigma-YAML detection rule for the portal-audit integration built in the
# custom-decoder lesson. It fires on a failed administrative sign-in to the
# internal portal from outside the corporate address space.
#
# Every field referenced under detection is a Wazuh Common Schema field and is
# produced by decoder/portal-audit-json/0 or decoder/portal-audit-text/0.
# The detection engine validates these names at rule creation and rejects the
# rule if any of them is not in the schema.
#
# Sources:
#   https://documentation.wazuh.com/5.0-beta/user-manual/data-analysis/rules.html
#   https://documentation.wazuh.com/5.0-beta/user-manual/wazuh-indexer/wazuh-sigma-rules.html
#   https://github.com/wazuh/wazuh/blob/main/docs/guide/migration/rules-4x-to-5x.md
#
# logsource.product must equal the integration title exactly (portal-audit).
---
id: "e22a8304-0cfe-48a2-b8e0-2f2585a89317"
enabled: true
status: "experimental"
level: "high"
logsource:
  product: "portal-audit"
  category: "authentication"
  service: "portal"
  definition: "Requires the portal-audit integration and its two decoders. The portal
    must be writing /var/log/portal/audit.log and the agent must collect it."
detection:
  condition: "selection and not filter_corporate_ranges"
  selection:
    event.dataset: "portal-audit"
    event.action: "authentication-failure"
    user.roles|contains: "admin"
  filter_corporate_ranges:
    source.ip|cidr:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
metadata:
  title: "Portal administrative sign-in failed from {{ source.ip }}"
  author: "Security engineering"
  date: "2026-09-22"
  modified: "2026-09-22"
  description: >-
    A sign-in to the internal portal by an account holding the admin role failed
    from an address outside the corporate ranges. Single events are common during
    password rotation; repeated failures from one address, or failures for accounts
    that never sign in remotely, are worth a call to the account holder.
  references:
    - "https://attack.mitre.org/techniques/T1078/"
  documentation: "Check user.name, source.ip and event.reason on the finding, then
    look for a nearby login.success from the same address."
  supports:
    - "linux"
mitre:
  tactic:
    - "TA0001"
    - "TA0006"
  technique:
    - "T1078"
    - "T1110"
  subtechnique:
    - "T1078.003"
compliance:
  pci_dss:
    - "8.3.1"
    - "10.2.4"
  iso_27001:
    - "A.8.5"
  nist_800_53:
    - "AC-7"
    - "AU-6"
tags:
  - "attack.initial-access"
  - "attack.credential-access"
  - "attack.t1078"
  - "attack.t1110"
falsepositives:
  - "Administrators signing in from home or from a mobile network during a password change"
  - "A stale credential in a monitoring script that still points at the portal"
  - "A corporate range missing from filter_corporate_ranges after a network change"