IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« AWS Access Token Used from Multiple Addresses Microsoft Entra ID High Risk Sign-in »
Elastic Docs ›Elastic Security [8.18] ›Downloadable rule update v8.18.6

Potential Microsoft 365 Brute Force via Entra ID Sign-Ins

edit
A newer version is available. Check out the latest documentation.

Potential Microsoft 365 Brute Force via Entra ID Sign-Ins

edit

Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 10m

Searches indices from: now-60m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: SaaS
  • Data Source: Azure
  • Data Source: Entra ID
  • Data Source: Entra ID Sign-in
  • Use Case: Identity and Access Audit
  • Use Case: Threat Detection
  • Tactic: Credential Access
  • Resources: Investigation Guide

Version: 104

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Potential Microsoft 365 Brute Force via Entra ID Sign-Ins

Identifies brute-force authentication activity against Microsoft 365 services using Entra ID sign-in logs. This detection groups and classifies failed sign-in attempts based on behavior indicative of password spraying, credential stuffing, or password guessing. The classification (bf_type) is included for immediate triage.

Possible investigation steps

  • Review bf_type: Classifies the brute-force behavior (password_spraying, credential_stuffing, password_guessing).
  • Examine user_id_list: Review the identities targeted. Are they admins, service accounts, or external identities?
  • Review login_errors: Multiple identical errors (e.g., "Invalid grant...") suggest automated abuse or tooling.
  • Check ip_list and source_orgs: Determine if requests came from known VPNs, hosting providers, or anonymized infrastructure.
  • Validate unique_ips and countries: Multiple countries or IPs in a short window may indicate credential stuffing or distributed spray attempts.
  • Compare total_attempts vs duration_seconds: High volume over a short duration supports non-human interaction.
  • Inspect user_agent.original via device_detail_browser: Clients like Python Requests or curl are highly suspicious.
  • Investigate client_app_display_name and incoming_token_type: Identify non-browser-based logins, token abuse or commonly mimicked clients like VSCode.
  • Review target_resource_display_name: Confirm the service being targeted (e.g., SharePoint, Exchange). This may be what authorization is being attempted against.
  • Pivot using session_id and device_detail_device_id: Determine if a single device is spraying multiple accounts.
  • Check conditional_access_status: If "notApplied", determine whether conditional access is properly scoped.
  • Correlate user_principal_name with successful sign-ins: Investigate surrounding logs for lateral movement or privilege abuse.

False positive analysis

  • Developer automation (e.g., CI/CD logins) or mobile sync errors may create noisy but benign login failures.
  • Red team exercises or pentesting can resemble brute-force patterns.
  • Legacy protocols or misconfigured service principals may trigger repeated login failures from the same IP or session.

Response and remediation

  • Notify identity or security operations teams to investigate further.
  • Lock or reset affected user accounts if compromise is suspected.
  • Block the source IP(s) or ASN temporarily using conditional access or firewall rules.
  • Review tenant-wide MFA and conditional access enforcement.
  • Audit targeted accounts for password reuse across systems or tenants.
  • Enable lockout or throttling policies for repeated failed login attempts.

Rule query

edit
FROM logs-azure.signinlogs*

| EVAL
    time_window = DATE_TRUNC(5 minutes, @timestamp),
    user_id = TO_LOWER(azure.signinlogs.properties.user_principal_name),
    ip = source.ip,
    login_error = azure.signinlogs.result_description,
    error_code = azure.signinlogs.result_type,
    request_type = TO_LOWER(azure.signinlogs.properties.incoming_token_type),
    app_name = TO_LOWER(azure.signinlogs.properties.app_display_name),
    asn_org = source.`as`.organization.name,
    country = source.geo.country_name,
    user_agent = user_agent.original,
    event_time = @timestamp

| WHERE event.dataset == "azure.signinlogs"
  AND event.category == "authentication"
  AND azure.signinlogs.category IN ("NonInteractiveUserSignInLogs", "SignInLogs")
  AND azure.signinlogs.properties.resource_display_name RLIKE "(.*)365|SharePoint|Exchange|Teams|Office(.*)"
  AND event.outcome == "failure"
  AND NOT STARTS_WITH("Account is locked", login_error)
  AND azure.signinlogs.result_type IN (
    "50034", // UserAccountNotFound
    "50126", // InvalidUserNameOrPassword
    "50053", // IdsLocked or too many sign-in failures
    "70000", // InvalidGrant
    "70008", // Expired or revoked refresh token
    "70043", // Bad token due to sign-in frequency
    "50057", // UserDisabled
    "50055", // Password expired
    "50056", // Invalid or null password
    "50064", // Credential validation failure
    "50076", // MFA required but not passed
    "50079", // MFA registration required
    "50105"  // EntitlementGrantsNotFound (no access to app)
  )
  AND user_id IS NOT NULL AND user_id != ""
  AND user_agent != "Mozilla/5.0 (compatible; MSAL 1.0) PKeyAuth/1.0"

| STATS
    authentication_requirement = VALUES(azure.signinlogs.properties.authentication_requirement),
    client_app_id = VALUES(azure.signinlogs.properties.app_id),
    client_app_display_name = VALUES(azure.signinlogs.properties.app_display_name),
    target_resource_id = VALUES(azure.signinlogs.properties.resource_id),
    target_resource_display_name = VALUES(azure.signinlogs.properties.resource_display_name),
    conditional_access_status = VALUES(azure.signinlogs.properties.conditional_access_status),
    device_detail_browser = VALUES(azure.signinlogs.properties.device_detail.browser),
    device_detail_device_id = VALUES(azure.signinlogs.properties.device_detail.device_id),
    incoming_token_type = VALUES(azure.signinlogs.properties.incoming_token_type),
    risk_state = VALUES(azure.signinlogs.properties.risk_state),
    session_id = VALUES(azure.signinlogs.properties.session_id),
    user_id = VALUES(azure.signinlogs.properties.user_id),
    user_principal_name = VALUES(azure.signinlogs.properties.user_principal_name),
    result_description = VALUES(azure.signinlogs.result_description),
    result_signature = VALUES(azure.signinlogs.result_signature),
    result_type = VALUES(azure.signinlogs.result_type),

    unique_users = COUNT_DISTINCT(user_id),
    user_id_list = VALUES(user_id),
    login_errors = VALUES(login_error),
    unique_login_errors = COUNT_DISTINCT(login_error),
    request_types = VALUES(request_type),
    app_names = VALUES(app_name),
    ip_list = VALUES(ip),
    unique_ips = COUNT_DISTINCT(ip),
    source_orgs = VALUES(asn_org),
    countries = VALUES(country),
    unique_country_count = COUNT_DISTINCT(country),
    unique_asn_orgs = COUNT_DISTINCT(asn_org),
    first_seen = MIN(event_time),
    last_seen = MAX(event_time),
    total_attempts = COUNT()
  BY time_window

| EVAL
    duration_seconds = DATE_DIFF("seconds", first_seen, last_seen),
    bf_type = CASE(
        unique_users >= 15 AND unique_login_errors == 1 AND total_attempts >= 10 AND duration_seconds <= 1800, "password_spraying",
        unique_users >= 8 AND total_attempts >= 15 AND unique_login_errors <= 3 AND unique_ips <= 5 AND duration_seconds <= 600, "credential_stuffing",
        unique_users == 1 AND unique_login_errors == 1 AND total_attempts >= 30 AND duration_seconds <= 300, "password_guessing",
        "other"
    )

| KEEP
    time_window, bf_type, duration_seconds, total_attempts, first_seen, last_seen,
    unique_users, user_id_list, login_errors, unique_login_errors, request_types,
    app_names, ip_list, unique_ips, source_orgs, countries,
    unique_country_count, unique_asn_orgs,

    authentication_requirement, client_app_id, client_app_display_name,
    target_resource_id, target_resource_display_name, conditional_access_status,
    device_detail_browser, device_detail_device_id, incoming_token_type,
    risk_state, session_id, user_id, user_principal_name,
    result_description, result_signature, result_type

| WHERE bf_type != "other"

Framework: MITRE ATT&CKTM

« AWS Access Token Used from Multiple Addresses Microsoft Entra ID High Risk Sign-in »