Detection rules › By event

M365-AzureActiveDirectoryStsLogon

Event	Rules
any	1
PasswordLogonInitialAuthUsingPassword	2
UserLoggedIn	17
UserLoginFailed	11

any

1 detection rules reference this event. View event page.

Kusto (1)

Malformed user agent severity medium T1071, T1189, T1203

PasswordLogonInitialAuthUsingPassword

2 detection rules reference this event. View event page.

Elastic (2)

M365 Identity User Account Lockouts severity medium T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004
M365 Identity User Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

UserLoggedIn

17 detection rules reference this event. View event page.

Sigma (1)

Azure Login Bypassing Conditional Access Policies severity high T1078

Elastic (7)

M365 Identity Login from Atypical Region severity medium T1078, T1078.004
M365 Identity Login from Impossible Travel Location severity medium T1078, T1078.004
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
M365 Identity OAuth Flow by User Sign-in to Device Registration severity high T1098, T1098.005, T1528, T1566, T1566.002
M365 Identity OAuth Phishing via First-Party Microsoft Application severity high T1078, T1078.004, T1566, T1566.002
M365 Identity OAuth ROPC Grant via Legacy Authentication Client severity medium T1078, T1078.004
M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA) severity high T1539, T1566

Splunk (3)

O365 Concurrent Sessions From Different Ips severity medium T1185
O365 Multiple AppIDs and UserAgents Authentication Spike severity low T1078
O365 Multiple OS Vendors Authenticating From User severity medium T1110

YARA-L (6)

Hunt for suspicious sign-in to Entra ID Using Extrnal Call Method severity medium
O365 AD PowerShell App Login Subsequent Activity severity medium T1098, T1098.001
O365 Admin Login Activity To Uncommon Microsoft Cloud Apps severity high T1078, T1078.004
O365 Login Activity To Azure AD PowerShell App severity medium T1078, T1078.004
O365 Login Activity To Uncommon Microsoft Cloud Apps severity medium T1078, T1078.004
O365 Persistent Login Activity To Azure AD PowerShell App severity medium T1021, T1021.007

UserLoginFailed

11 detection rules reference this event. View event page.

Elastic (2)

M365 Identity User Account Lockouts severity medium T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004
M365 Identity User Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Splunk (8)

High Number of Login Failures from a single source severity low T1110, T1110.001
O365 Excessive SSO logon errors severity low T1556
O365 High Number Of Failed Authentications for User severity medium T1110, T1110.001
O365 Multi-Source Failed Authentications Spike T1110, T1110.003, T1110.004, T1586, T1586.003
O365 Multiple AppIDs and UserAgents Authentication Spike severity low T1078
O365 Multiple Failed MFA Requests For User severity medium T1621
O365 Multiple OS Vendors Authenticating From User severity medium T1110
O365 Multiple Users Failing To Authenticate From Ip severity medium T1110, T1110.003, T1110.004, T1586, T1586.003

Panther (1)

Microsoft365 Brute Force Login by User severity medium T1110