O365 Multiple AppIDs and UserAgents Authentication Spike

Status: production
Severity: low
Group by: _time, aws::recipientAccountId, dest, src, user, vendor_product
Author: Mauricio Velazco, Splunk
Source: github.com/splunk/security_content

The following analytic identifies unusual authentication activity in an O365 environment, where a single user account experiences more than 8 authentication attempts using 3 or more unique application IDs and over 5 unique user agents within a short timeframe. It leverages O365 audit logs, focusing on authentication events and applying statistical thresholds. This behavior is significant as it may indicate an adversary probing for multi-factor authentication weaknesses. If confirmed malicious, it suggests a compromised account, potentially leading to unauthorized access, privilege escalation, and data exfiltration. Early detection is crucial to prevent further exploitation.

Known false positives

Rapid authentication from the same user using more than 5 different user agents and 3 application IDs is highly unlikely under normal circumstances. However, there are potential scenarios that could lead to false positives.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
Microsoft 365	UserLoggedIn
Microsoft 365	UserLoginFailed

Rules detecting the same action

These rules filter on the same operation.

High Number of Login Failures from a single source (Splunk)
M365 Identity Login from Atypical Region (Elastic)
M365 Identity Login from Impossible Travel Location (Elastic)
M365 Identity User Account Lockouts (Elastic)
M365 Identity User Brute Force Attempted (Elastic)
O365 Concurrent Sessions From Different Ips (Splunk)
O365 Excessive SSO logon errors (Splunk)
O365 High Number Of Failed Authentications for User (Splunk)

Rule body

name: O365 Multiple AppIDs and UserAgents Authentication Spike
id: 66adc486-224d-45c1-8e4d-9e7eeaba988f
version: 11
creation_date: '2023-12-06'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Anomaly
description: The following analytic identifies unusual authentication activity in an O365 environment, where a single user account experiences more than 8 authentication attempts using 3 or more unique application IDs and over 5 unique user agents within a short timeframe. It leverages O365 audit logs, focusing on authentication events and applying statistical thresholds. This behavior is significant as it may indicate an adversary probing for multi-factor authentication weaknesses. If confirmed malicious, it suggests a compromised account, potentially leading to unauthorized access, privilege escalation, and data exfiltration. Early detection is crucial to prevent further exploitation.
data_source:
    - O365 UserLoggedIn
    - O365 UserLoginFailed
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn OR Operation=UserLoginFailed)
      | bucket span=5m _time
      | stats dc(_raw) as failed_attempts dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) values(OS) values(signature) as signature
        BY _time user src
           vendor_account vendor_product dest
      | where failed_attempts > 5 and unique_user_agents > 5 and unique_app_ids > 2
      | `o365_multiple_appids_and_useragents_authentication_spike_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Rapid authentication from the same user using more than 5 different user agents and 3 application IDs is highly unlikely under normal circumstances. However, there are potential scenarios that could lead to false positives.
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/
    - https://github.com/dafthack/MFASweep
    - https://www.youtube.com/watch?v=SK1zgqaAZ2E
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: $user$ authenticated in a short period of time with more than 5 different user agents across 3 or more unique application ids.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

Stages and Predicates

Stage 1: `search`

`o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn OR Operation=UserLoginFailed)

Stage 2: `bucket`

| bucket span=5m _time

Stage 3: `stats`

| stats dc(_raw) as failed_attempts dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) values(OS) values(signature) as signature
    BY _time user src
       vendor_account vendor_product dest

Stage 4: `where`

| where failed_attempts > 5 and unique_user_agents > 5 and unique_app_ids > 2

Stage 5: `search`

| `o365_multiple_appids_and_useragents_authentication_spike_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Operation`	eq	`UserLoggedIn` `UserLoginFailed`	`field:"Operation" kind:eq`
`Workload`	eq	`AzureActiveDirectory`	`field:"Workload" kind:eq value:"AzureActiveDirectory"`
`failed_attempts`	gt	`5`	`field:"failed_attempts" kind:gt value:"5"`
`sourcetype`	eq	`o365:management:activity`	`field:"sourcetype" kind:eq value:"o365:management:activity"`
`unique_app_ids`	gt	`2`	`field:"unique_app_ids" kind:gt value:"2"`
`unique_user_agents`	gt	`5`	`field:"unique_user_agents" kind:gt value:"5"`