Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts.
Rule type: threshold
Risk score: 73
Runs every: 5 minutes
Maximum alerts per execution: 100
- Microsoft 365
- Continuous Monitoring
- Identity and Access
Added (Elastic Stack release): 7.11.0
Rule authors: Elastic
Rule license: Elastic License
Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.
The Microsoft 365 Fleet integration or Filebeat module must be enabled to use this rule.
event.dataset:o365.audit and event.provider:AzureActiveDirectory and event.category:authentication and event.action:UserLoginFailed and event.outcome:failure