Failed sign-ins into LastPass due to MFA

Status: available
Severity: low
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

This rule will check if a sign-in failed into LastPass due to MFA. An incident can indicate the potential brute forcing of a LastPass account. The use of MFA is identified by combining the sign-in logs, this rule assumes LastPass is federated to Entra ID.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts `T1190` Exploit Public-Facing Application

Telemetry coverage

Platform	Record / event type
Entra ID	`SigninLogs` sign-in event: Sign-in with an incomplete or failed MFA challenge
Entra ID	`SigninLogs` sign-in event: Sign-in naming a target application

Rules detecting the same action

These rules filter on the same operation.

Cisco - firewall block but success logon to Microsoft Entra ID (Kusto)
Entra ID Sign-in Brute Force Attempted (Microsoft 365) (Elastic)
Entra ID User Sign-in Brute Force Attempted (Elastic)
Multifactor Authentication Interrupted (Sigma)

Rule body

id: 760b8467-e6cc-4006-9149-5696845c1a54
name: Failed sign-ins into LastPass due to MFA
description: |
  'This rule will check if a sign-in failed into LastPass due to MFA.
  An incident can indicate the potential brute forcing of a LastPass account. 
  The use of MFA is identified by combining the sign-in logs, this rule assumes LastPass is federated to Entra ID.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: LastPass
    dataTypes:
      - LastPassNativePoller_CL
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
  - InitialAccess
relevantTechniques:
 - T1078
 - T1190
query: |
  LastPassNativePoller_CL
  | where Action_s == "Log in"
  | join (SigninLogs | where AppDisplayName == "LastPass Enterprise") on $left.IP_Address_s == $right.IPAddress and $left.Username_s == $right.UserPrincipalName
  | where ResultType in (50074, 50076)
  | extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

LastPassNativePoller_CL

Stage 2: `where`

| where Action_s == "Log in"

Stage 3: `join`

| join (SigninLogs | where AppDisplayName == "LastPass Enterprise") on $left.IP_Address_s == $right.IPAddress and $left.Username_s == $right.UserPrincipalName

Stage 4: `where`

| where ResultType in (50074, 50076)

Stage 5: `extend`

| extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action_s`	eq	`Log in`	`field:"Action_s" kind:eq value:"Log in"`
`AppDisplayName`	eq	`LastPass Enterprise`	`field:"AppDisplayName" kind:eq value:"LastPass Enterprise"`
`ResultType`	in	`50074` `50076`	`field:"ResultType" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`