Try in Splunk Security Cloud

Description

This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes

  • Type: Anomaly
  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • Last Updated: 2020-12-16
  • Author: Rod Soto, Splunk
  • ID: d441364c-349c-453b-b55f-12eccab67cf9

ATT&CK

ID Technique Tactic
T1110 Brute Force Credential Access
`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed 
| stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user 
| where count > 10 
|`security_content_ctime(firstTime)` 
|`security_content_ctime(lastTime)` 
| `o365_excessive_authentication_failures_alert_filter`

Associated Analytic Story

How To Implement

You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

  • _time
  • Workload
  • UserAuthenticationMethod
  • status
  • UserAgent
  • src_ip
  • user

Kill Chain Phase

  • Not Applicable

Known False Positives

The threshold for alert is above 10 attempts and this should reduce the number of false positives.

RBA

Risk Score Impact Confidence Message
64.0 80 80 User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1