Techniques
Sample rules
Azure AD Unusual Number of Failed Authentications From Ip
- source: splunk
- technicques:
- T1110.003
- T1110.004
- T1586.003
Description
The following analytic identifies a single source IP failing to authenticate with multiple valid users, potentially indicating a Password Spraying attack against an Azure Active Directory tenant. It uses Azure SignInLogs data and calculates the standard deviation for source IPs, applying the 3-sigma rule to detect unusual numbers of failed authentication attempts. This activity is significant as it may signal an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information.
Detection logic
`azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
| rename properties.* as *
| bucket span=5m _time
| stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as userPrincipalName values(dest) as dest values(user) as user by _time, src, vendor_account, vendor_product
| eventstats avg(unique_accounts) as ip_avg, stdev(unique_accounts) as ip_std by src
| eval upperBound=(ip_avg+ip_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1,0)
| where isOutlier = 1
| `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`
Azure AD Multiple Users Failing To Authenticate From Ip
- source: splunk
- technicques:
- T1110.003
- T1110.004
- T1586.003
Description
The following analytic detects a single source IP failing to authenticate with 30 unique valid users within 5 minutes in Azure Active Directory. It leverages Azure AD SignInLogs with error code 50126, indicating invalid passwords. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or privilege escalation within the Azure AD environment.
Detection logic
`azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
| rename properties.* as *
| bucket span=5m _time
| rename userAgent as user_agent
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime dc(user) as unique_user values(dest) as dest values(user) as user values(user_agent) as user_agent values(vendor_account) as vendor_account values(vendor_product) as vendor_product by src signature
| where unique_user > 30
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`