Detection rules › Splunk
O365 Excessive SSO logon errors
The following analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors. It leverages data from the o365_management_activity dataset, focusing on failed user login attempts with SSO errors. This activity is significant as it may indicate brute-force attempts or the hijacking/reuse of SSO tokens. If confirmed malicious, attackers could potentially gain unauthorized access to user accounts, leading to data breaches, privilege escalation, or further lateral movement within the organization.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1556 Modify Authentication Process |
| Defense Impairment | T1556 Modify Authentication Process |
| Credential Access | T1556 Modify Authentication Process |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- High Number of Login Failures from a single source (Splunk)
- M365 Identity User Account Lockouts (Elastic)
- M365 Identity User Brute Force Attempted (Elastic)
- O365 High Number Of Failed Authentications for User (Splunk)
- O365 Multi-Source Failed Authentications Spike (Splunk)
- O365 Multiple AppIDs and UserAgents Authentication Spike (Splunk)
- O365 Multiple Failed MFA Requests For User (Splunk)
- O365 Multiple Users Failing To Authenticate From Ip (Splunk)
Rule body splunk
name: O365 Excessive SSO logon errors
id: 8158ccc4-6038-11eb-ae93-0242ac130002
version: 12
creation_date: '2021-01-26'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: Anomaly
description: The following analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors. It leverages data from the `o365_management_activity` dataset, focusing on failed user login attempts with SSO errors. This activity is significant as it may indicate brute-force attempts or the hijacking/reuse of SSO tokens. If confirmed malicious, attackers could potentially gain unauthorized access to user accounts, leading to data breaches, privilege escalation, or further lateral movement within the organization.
data_source:
- O365 UserLoginFailed
search: |-
`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed
| stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
BY src vendor_account vendor_product
dest signature user_agent
| where count >= 5
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_excessive_sso_logon_errors_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
references:
- https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/
drilldown_searches:
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: "0"
intermediate_findings:
entities:
- field: user
type: user
score: 20
message: Excessive number of SSO logon errors from $src$ using UserAgent $user_agent$.
threat_objects:
- field: src
type: ip_address
analytic_story:
- Office 365 Account Takeover
- Cloud Federated Credential Abuse
asset_type: O365 Tenant
mitre_attack_id:
- T1556
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: cloud
security_domain: threat
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2.json
sourcetype: o365:management:activity
source: o365
test_type: unit
Stages and Predicates
Stage 1: search
`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed
Stage 2: stats
| stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
BY src vendor_account vendor_product
dest signature user_agent
Stage 3: where
| where count >= 5
Stage 4: search
| `security_content_ctime(firstTime)`
Stage 5: search
| `security_content_ctime(lastTime)`
Stage 6: search
| `o365_excessive_sso_logon_errors_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
LogonError | eq |
|
Operation | eq |
|
Workload | eq |
|
count | ge |
|
sourcetype | eq |
|