Azure AD STS logon events

Kusto #

• Malformed user agent source medium: Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware.T1071, T1189, T1203

Elastic #

• M365 Identity User Brute Force Attempted source medium: Identifies brute-force authentication activity targeting Microsoft 365 user accounts using failed sign-in patterns that match password spraying, credential stuffing, or password guessing behavior. Adversaries may attempt brute-force authentication with credentials obtained from previous breaches, leaks, marketplaces or guessable passwords.T1110, T1110.001, T1110.003, T1110.004↳ also matches UserLoginFailed
• M365 Identity User Account Lockouts source medium: Detects a burst of Microsoft 365 user account lockouts within a short 5-minute window. A high number of IdsLocked login errors across multiple user accounts may indicate brute-force attempts for the same users resulting in lockouts.T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004↳ also matches UserLoginFailed

Sigma #

• Azure Login Bypassing Conditional Access Policies source high: Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.T1078

Elastic #

• M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs source high: Identifies sign-ins on behalf of a principal user to the Microsoft Graph or legacy Azure AD API from multiple IPs using first-party Microsoft applications from the FOCI (Family of Client IDs) group. Developer tools like Azure CLI, VSCode, and Azure PowerShell accessing these resources from multiple IPs are flagged, along with any FOCI application accessing the deprecated Windows Azure Active Directory from multiple IPs. This behavior may indicate an adversary using a phished OAuth authorization code or refresh token, as seen in attacks like ConsentFix where attackers steal localhost OAuth codes and replay them from attacker infrastructure.T1078, T1078.004, T1528, T1550, T1550.001, T1566
• M365 Identity Login from Atypical Region source medium: Detects successful Microsoft 365 portal logins from a country and region the user has not previously authenticated from in a specific time window. Atypical regions are identified by combining the user's country and region geolocation history; an authentication from a new country/region pair for that user may indicate an adversary attempting to access the account from an unusual location or behind a VPN.T1078, T1078.004
• M365 Identity Login from Impossible Travel Location source medium: Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from a different location.T1078, T1078.004

Show 4 more (7 total) on the rules page

Splunk #

• O365 Concurrent Sessions From Different Ips source: The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for…T1185
• O365 Multiple AppIDs and UserAgents Authentication Spike source: The following analytic identifies unusual authentication activity in an O365 environment, where a single user account experiences more than 8 authentication attempts using 3 or more unique application IDs and over 5 unique user agents…T1078↳ also matches UserLoginFailed
• O365 Multiple OS Vendors Authenticating From User source: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various…T1110↳ also matches UserLoginFailed

YARA-L #

• O365 Admin Login Activity To Uncommon Microsoft Cloud Apps source high: This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004
• O365 Login Activity To Azure AD PowerShell App source medium: Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programmatic access to Entra ID (Azure AD) should generally be through apps, so reviewing these activities is needed.T1078, T1078.004
• O365 Login Activity To Uncommon Microsoft Cloud Apps source medium: This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004

Show 3 more (6 total) on the rules page

Elastic #

• M365 Identity User Brute Force Attempted source medium: Identifies brute-force authentication activity targeting Microsoft 365 user accounts using failed sign-in patterns that match password spraying, credential stuffing, or password guessing behavior. Adversaries may attempt brute-force authentication with credentials obtained from previous breaches, leaks, marketplaces or guessable passwords.T1110, T1110.001, T1110.003, T1110.004↳ also matches PasswordLogonInitialAuthUsingPassword
• M365 Identity User Account Lockouts source medium: Detects a burst of Microsoft 365 user account lockouts within a short 5-minute window. A high number of IdsLocked login errors across multiple user accounts may indicate brute-force attempts for the same users resulting in lockouts.T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004↳ also matches PasswordLogonInitialAuthUsingPassword

Splunk #

• High Number of Login Failures from a single source source: The following analytic detects multiple failed login attempts in Office365 Azure Active Directory from a single source IP address. It leverages Office365 management activity logs, specifically AzureActiveDirectoryStsLogon records,…T1110, T1110.001
• O365 Excessive SSO logon errors source: The following analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors. It leverages data from the o365_management_activity dataset, focusing on failed user login attempts with SSO errors. This activity…T1556
• O365 High Number Of Failed Authentications for User source: The following analytic identifies an O365 account experiencing more than 20 failed authentication attempts within 5 minutes. It uses O365 Unified Audit Logs, specifically "UserLoginFailed" events, to monitor and flag accounts exceeding…T1110, T1110.001

Show 5 more (8 total) on the rules page

Panther #

• Microsoft365 Brute Force Login by User source medium: A Microsoft365 user was denied login access several timesT1110