Deprecated - Potential Password Spraying of Microsoft 365 User Accounts

Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts.

Rule type: threshold
Rule indices:

• filebeat-*
• logs-o365*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-30m
Maximum alerts per execution: 100
References:

Tags:

• Domain: Cloud
• Data Source: Microsoft 365
• Use Case: Identity and Access Audit
• Tactic: Credential Access

Version: 208
Rule authors:

• Elastic

Rule license: Elastic License v2

This rule has been deprecated in favor of Attempts to Brute Force a Microsoft 365 User Account (26f68dba-ce29-497b-8e13-b4fde1db5a2d).

event.dataset:o365.audit and event.provider:(Exchange or AzureActiveDirectory) and event.category:authentication and
event.action:("UserLoginFailed" or "PasswordLogonInitialAuthUsingPassword")
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Credential Access
  • Id: TA0006
  • Reference URL: https://attack.mitre.org/tactics/TA0006/

• Technique:

  • Name: Brute Force
  • Id: T1110
  • Reference URL: https://attack.mitre.org/techniques/T1110/