IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Attempted Private Key Access Attempts to Brute Force an Okta User Account »
Elastic Docs ›Elastic Security [8.12] ›Detections and alerts ›Prebuilt rule reference

Attempts to Brute Force a Microsoft 365 User Account

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Attempts to Brute Force a Microsoft 365 User Account

edit

Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: SaaS
  • Data Source: Microsoft 365
  • Use Case: Identity and Access Audit
  • Tactic: Credential Access

Version: 210

Rule authors:

  • Elastic
  • Willem D’Haese
  • Austin Songer

Rule license: Elastic License v2

Investigation guide

edit

Setup

edit

The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

Rule query

edit
from logs-o365.audit-*
| MV_EXPAND event.category
| WHERE event.dataset == "o365.audit"
  AND event.category == "authentication"

  // filter only on Entra ID or Exchange audit logs in O365 integration
  AND event.provider in ("AzureActiveDirectory", "Exchange")

  // filter only for UserLoginFailed or partial failures
  AND event.action in ("UserLoginFailed", "PasswordLogonInitialAuthUsingPassword")

  // ignore specific logon errors
  AND not o365.audit.LogonError in (
    "EntitlementGrantsNotFound",
    "UserStrongAuthEnrollmentRequired",
    "UserStrongAuthClientAuthNRequired",
    "InvalidReplyTo",
    "SsoArtifactExpiredDueToConditionalAccess",
    "PasswordResetRegistrationRequiredInterrupt",
    "SsoUserAccountNotFoundInResourceTenant",
    "UserStrongAuthExpired",
    "CmsiInterrupt"
)
  // filters out non user or application logins based on target
  AND o365.audit.Target.Type in ("0", "2", "3", "5", "6", "10")

  // filters only for logins from user or application, ignoring oauth:token
  AND to_lower(o365.audit.ExtendedProperties.RequestType) rlike "(.*)login(.*)"

// keep only relevant fields
| keep event.provider, event.dataset, event.category, o365.audit.UserId, event.action, source.ip, o365.audit.LogonError, o365.audit.ExtendedProperties.RequestType, o365.audit.Target.Type, target_time_window

| STATS
  // count the number of failed login attempts target per user
  login_attempt_counts = COUNT(*) by o365.audit.Target.ID, o365.audit.LogonError

| WHERE login_attempt_counts > 10

Framework: MITRE ATT&CKTM

« Attempted Private Key Access Attempts to Brute Force an Okta User Account »