Detection rules › By catalog entry

M365-AzureActiveDirectoryStsLogon

Catalog entry	Rules
any	1
PasswordLogonInitialAuthUsingPassword	2
UserLoggedIn	17
UserLoginFailed	11

any

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Malformed user agent severity medium T1071,T1189,T1203

PasswordLogonInitialAuthUsingPassword

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

M365 Identity User Account Lockouts severity medium T1078,T1078.004,T1110,T1110.001,T1110.003,T1110.004
M365 Identity User Brute Force Attempted severity medium T1110,T1110.001,T1110.003,T1110.004

UserLoggedIn

17 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Azure Login Bypassing Conditional Access Policies severity high T1078

Elastic (7)

Splunk (3)

O365 Concurrent Sessions From Different Ips severity medium T1185
O365 Multiple AppIDs and UserAgents Authentication Spike severity low T1078
O365 Multiple OS Vendors Authenticating From User severity medium T1110

YARA-L (6)

Hunt for suspicious sign-in to Entra ID Using Extrnal Call Method severity medium
O365 AD PowerShell App Login Subsequent Activity severity medium T1098,T1098.001
O365 Admin Login Activity To Uncommon Microsoft Cloud Apps severity high T1078,T1078.004
O365 Login Activity To Azure AD PowerShell App severity medium T1078,T1078.004
O365 Login Activity To Uncommon Microsoft Cloud Apps severity medium T1078,T1078.004
O365 Persistent Login Activity To Azure AD PowerShell App severity medium T1021,T1021.007

UserLoginFailed

11 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

M365 Identity User Account Lockouts severity medium T1078,T1078.004,T1110,T1110.001,T1110.003,T1110.004
M365 Identity User Brute Force Attempted severity medium T1110,T1110.001,T1110.003,T1110.004

Splunk (8)

High Number of Login Failures from a single source severity low T1110,T1110.001
O365 Excessive SSO logon errors severity low T1556
O365 High Number Of Failed Authentications for User severity medium T1110,T1110.001
O365 Multi-Source Failed Authentications Spike T1110,T1110.003,T1110.004,T1586,T1586.003
O365 Multiple AppIDs and UserAgents Authentication Spike severity low T1078
O365 Multiple Failed MFA Requests For User severity medium T1621
O365 Multiple OS Vendors Authenticating From User severity medium T1110
O365 Multiple Users Failing To Authenticate From Ip severity medium T1110,T1110.003,T1110.004,T1586,T1586.003

Panther (1)

Microsoft365 Brute Force Login by User severity medium T1110

Back to all M365-AzureActiveDirectoryStsLogon catalog entries