« Attempted Private Key Access Attempts to Brute Force an Okta User Account »
Elastic Docs ›Elastic Security Solution [8.14] ›Detections and alerts ›Prebuilt rule reference

Attempts to Brute Force a Microsoft 365 User Account

edit

Attempts to Brute Force a Microsoft 365 User Accountedit

Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: SaaS
  • Data Source: Microsoft 365
  • Use Case: Identity and Access Audit
  • Tactic: Credential Access

Version: 209

Rule authors:

  • Elastic
  • Willem D’Haese
  • Austin Songer

Rule license: Elastic License v2

Investigation guideedit

Setupedit

The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

Rule queryedit

from logs-o365.audit-*
| MV_EXPAND event.category
| WHERE event.dataset == "o365.audit"
  AND event.category == "authentication"

  // filter only on Entra ID or Exchange audit logs in O365 integration
  AND event.provider in ("AzureActiveDirectory", "Exchange")

  // filter only for UserLoginFailed or partial failures
  AND event.action in ("UserLoginFailed", "PasswordLogonInitialAuthUsingPassword")

  // ignore specific logon errors
  AND not o365.audit.LogonError in (
    "EntitlementGrantsNotFound",
    "UserStrongAuthEnrollmentRequired",
    "UserStrongAuthClientAuthNRequired",
    "InvalidReplyTo",
    "SsoArtifactExpiredDueToConditionalAccess",
    "PasswordResetRegistrationRequiredInterrupt",
    "SsoUserAccountNotFoundInResourceTenant",
    "UserStrongAuthExpired",
    "CmsiInterrupt"
)
  // filters out non user or application logins based on target
  AND o365.audit.Target.Type in ("0", "2", "3", "5", "6", "10")

  // filters only for logins from user or application, ignoring oauth:token
  AND to_lower(o365.audit.ExtendedProperties.RequestType) rlike "(.*)login(.*)"

| STATS
  // count the number of failed login attempts target per user
  login_attempt_counts = COUNT(*) by o365.audit.Target.ID, o365.audit.LogonError

| WHERE login_attempt_counts > 10

Framework: MITRE ATT&CKTM

« Attempted Private Key Access Attempts to Brute Force an Okta User Account »