ID | Technique | Tactic |
---|---|---|
T1110 | Brute Force | Credential Access |
Detection: O365 Excessive Authentication Failures Alert
Description
The following analytic identifies an excessive number of authentication failures, including failed attempts against MFA prompt codes. It uses data from the o365_management_activity
dataset, focusing on events where the authentication status is marked as failure. This behavior is significant as it may indicate a brute force attack or an attempt to compromise user accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the environment.
Search
1`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure
2| stats count earliest(_time) AS firstTime latest(_time) AS lastTime values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user
3| where count > 10
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)`
6| `o365_excessive_authentication_failures_alert_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
N/A | N/A | N/A | N/A | N/A |
Macros Used
Name | Value |
---|---|
o365_management_activity | sourcetype=o365:management:activity |
o365_excessive_authentication_failures_alert_filter | search * |
o365_excessive_authentication_failures_alert_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
Known False Positives
The threshold for alert is above 10 attempts and this should reduce the number of false positives.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. | 64 | 80 | 80 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | o365 |
o365:management:activity |
Integration | ✅ Passing | Dataset | o365 |
o365:management:activity |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 3