Try in Splunk Security Cloud


Monitor for activities and techniques associated with Account Takover attacks against Azure Active Directory tenants.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • Last Updated: 2022-07-14
  • Author: Mauricio Velazco, Splunk
  • ID: 41514c46-7118-4eab-a9bb-f3bfa4e3bea9


Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization.\ This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.


Name Technique Type
Azure AD Authentication Failed During MFA Challenge Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation TTP
Azure AD Multiple Users Failing To Authenticate From Ip Brute Force, Password Spraying Anomaly
Azure AD Successful PowerShell Authentication Valid Accounts, Cloud Accounts TTP
Azure AD Successful Single-Factor Authentication Security Account Manager TTP
Azure AD Unusual Number of Failed Authentications From Ip Brute Force, Password Spraying Anomaly
Azure Active Directory High Risk Sign-in Brute Force, Password Spraying TTP


source | version: 2