ZIA Insecure Password Settings

Description

This rule detects when password settings are insecure.

Query · python

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    auth_frequency = event.deep_get(
        "event",
        "postaction",
        "authFrequency",
        default="<AUTH_FREQUENCY_NOT_FOUND>",
    )
    password_expiry = event.deep_get(
        "event",
        "postaction",
        "passwordExpiry",
        default="<PASSWORD_EXPIRY_NOT_FOUND>",
    )
    password_strength = event.deep_get(
        "event",
        "postaction",
        "passwordStrength",
        default="<PASSWORD_STRENGTH_NOT_FOUND>",
    )
    if (
        auth_frequency == "PERMANENT_COOKIE"
        or password_expiry == "NEVER"  # nosec bandit B105
        or password_strength == "NONE"  # nosec bandit B105
    ):
        return True
    return False


def dedup(event):
    return event.deep_get("event", "adminid", default="<ADMIN_ID_NOT_FOUND>")


def title(event):
    return (
        f"[Zscaler.ZIA]: Password settings are insecure for admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

Analyst notes

Set the secure password configurations.

Raw source ZIA Insecure Password Settings · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
RuleID: ZIA.Insecure.Password.Settings
Description: This rule detects when password settings are insecure.
DisplayName: ZIA Insecure Password Settings
Runbook: Set the secure password configurations.
Reference: https://help.zscaler.com/zia/customizing-your-admin-account-settings
Enabled: true
Filename: zia_insecure_password_settings.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1556.009 # Defense Evasion: Modify Authentication Process: Conditional Access Policies
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: Permanent cookie
    ExpectedResult: true
    Log:
      {
        "event": {
          "action": "UPDATE",
          "adminid": "admin@test.zscalerbeta.net",
          "auditlogtype": "ZIA",
          "category": "AUTHENTICATION_SETTINGS",
          "clientip": "1.2.3.4",
          "errorcode": "None",
          "interface": "UI",
          "postaction": {
            "authFrequency": "PERMANENT_COOKIE",
            "autoProvision": false,
            "directorySyncMigrateToScimEnabled": false,
            "kerberosEnabled": false,
            "mobileAdminSamlIdpEnabled": false,
            "oneTimeAuth": "OTP_DISABLED",
            "orgAuthType": "SAFECHANNEL_DIR",
            "passwordExpiry": "NEVER",
            "passwordStrength": "NONE",
            "samlEnabled": false
          },
          "preaction": {
            "authFrequency": "DAILY_COOKIE",
            "autoProvision": false,
            "directorySyncMigrateToScimEnabled": false,
            "kerberosEnabled": false,
            "mobileAdminSamlIdpEnabled": false,
            "oneTimeAuth": "OTP_DISABLED",
            "orgAuthType": "SAFECHANNEL_DIR",
            "passwordExpiry": "NEVER",
            "passwordStrength": "NONE",
            "samlEnabled": false
          },
          "recordid": "356",
          "resource": "None",
          "result": "SUCCESS",
          "subcategory": "AUTH_SETTINGS_PROFILE",
          "time": "2024-11-04 16:29:24.000000000"
        },
        "sourcetype": "zscalernss-audit"
      }
  - Name: Password expiry - never
    ExpectedResult: true
    Log:
      {
        "event": {
          "action": "UPDATE",
          "adminid": "admin@test.zscalerbeta.net",
          "auditlogtype": "ZIA",
          "category": "AUTHENTICATION_SETTINGS",
          "clientip": "1.2.3.4",
          "errorcode": "None",
          "interface": "UI",
          "postaction": {
            "authFrequency": "DAILY_COOKIE",
            "autoProvision": false,
            "directorySyncMigrateToScimEnabled": false,
            "kerberosEnabled": false,
            "mobileAdminSamlIdpEnabled": false,
            "oneTimeAuth": "OTP_LINK",
            "orgAuthType": "SAFECHANNEL_DIR",
            "passwordExpiry": "NEVER",
            "passwordStrength": "NONE",
            "samlEnabled": false
          },
          "preaction": {
            "authFrequency": "DAILY_COOKIE",
            "autoProvision": false,
            "directorySyncMigrateToScimEnabled": false,
            "kerberosEnabled": false,
            "mobileAdminSamlIdpEnabled": false,
            "oneTimeAuth": "OTP_DISABLED",
            "orgAuthType": "SAFECHANNEL_DIR",
            "passwordExpiry": "NEVER",
            "passwordStrength": "NONE",
            "samlEnabled": false
          },
          "recordid": "357",
          "resource": "None",
          "result": "SUCCESS",
          "subcategory": "AUTH_SETTINGS_PROFILE",
          "time": "2024-11-04 16:29:40.000000000"
        },
        "sourcetype": "zscalernss-audit"
      }
  - Name: Password strength - none
    ExpectedResult: true
    Log:
      {
        "event": {
          "action": "UPDATE",
          "adminid": "admin@test.zscalerbeta.net",
          "auditlogtype": "ZIA",
          "category": "AUTHENTICATION_SETTINGS",
          "clientip": "1.2.3.4",
          "errorcode": "None",
          "interface": "UI",
          "postaction": {
            "authFrequency": "DAILY_COOKIE",
            "autoProvision": false,
            "directorySyncMigrateToScimEnabled": false,
            "kerberosEnabled": false,
            "mobileAdminSamlIdpEnabled": false,
            "oneTimeAuth": "OTP_DISABLED",
            "orgAuthType": "SAFECHANNEL_DIR",
            "passwordExpiry": "SIX_MONTHS",
            "passwordStrength": "NONE",
            "samlEnabled": false
          },
          "preaction": {
            "authFrequency": "DAILY_COOKIE",
            "autoProvision": false,
            "directorySyncMigrateToScimEnabled": false,
            "kerberosEnabled": false,
            "mobileAdminSamlIdpEnabled": false,
            "oneTimeAuth": "OTP_DISABLED",
            "orgAuthType": "SAFECHANNEL_DIR",
            "passwordExpiry": "NEVER",
            "passwordStrength": "NONE",
            "samlEnabled": false
          },
          "recordid": "361",
          "resource": "None",
          "result": "SUCCESS",
          "subcategory": "AUTH_SETTINGS_PROFILE",
          "time": "2024-11-04 16:30:36.000000000"
        },
        "sourcetype": "zscalernss-audit"
      }
  - Name: Other event
    ExpectedResult: false
    Log:
      {
        "event": {
          "action": "SIGN_IN",
          "adminid": "admin@test.zscalerbeta.net",
          "auditlogtype": "ZIA",
          "category": "LOGIN",
          "clientip": "1.2.3.4",
          "errorcode": "None",
          "interface": "UI",
          "postaction": { },
          "preaction": { },
          "recordid": "354",
          "resource": "None",
          "result": "SUCCESS",
          "subcategory": "LOGIN",
          "time": "2024-11-04 16:27:37.000000000"
        },
        "sourcetype": "zscalernss-audit"
      }


# ------ paired body: zia_insecure_password_settings.py ------

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    auth_frequency = event.deep_get(
        "event",
        "postaction",
        "authFrequency",
        default="<AUTH_FREQUENCY_NOT_FOUND>",
    )
    password_expiry = event.deep_get(
        "event",
        "postaction",
        "passwordExpiry",
        default="<PASSWORD_EXPIRY_NOT_FOUND>",
    )
    password_strength = event.deep_get(
        "event",
        "postaction",
        "passwordStrength",
        default="<PASSWORD_STRENGTH_NOT_FOUND>",
    )
    if (
        auth_frequency == "PERMANENT_COOKIE"
        or password_expiry == "NEVER"  # nosec bandit B105
        or password_strength == "NONE"  # nosec bandit B105
    ):
        return True
    return False


def dedup(event):
    return event.deep_get("event", "adminid", default="<ADMIN_ID_NOT_FOUND>")


def title(event):
    return (
        f"[Zscaler.ZIA]: Password settings are insecure for admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.