Repeated failed MFA challenges for one user from one IP AADSTS50074 AADSTS500121

SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType in ("50074", "500121")
| summarize Prompts = count(),
            ResultTypes = make_set(ResultType),
            FirstSeen = min(CreatedDateTime),
            LastSeen = max(CreatedDateTime),
            Apps = make_set(AppDisplayName, 5)
          by UserPrincipalName, IPAddress
| where Prompts >= 3
| sort by Prompts desc

queryFrequency: 1h
entityMappings:
- fieldMappings:
  - columnName: UserPrincipalName
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: IPAddress
    identifier: Address
  entityType: IP
triggerThreshold: 0
metadata:
  support:
    tier: Community
  source:
    kind: Community
  categories:
    domains:
    - Security - Others
    - Identity
  author:
    name: Bram Brinkmeier
triggerOperator: gt
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/MFAPromptBurstFromSingleIP.yaml
query: |
  SigninLogs
  | where TimeGenerated > ago(1h)
  | where ResultType in ("50074", "500121")
  | summarize Prompts = count(),
              ResultTypes = make_set(ResultType),
              FirstSeen = min(CreatedDateTime),
              LastSeen = max(CreatedDateTime),
              Apps = make_set(AppDisplayName, 5)
            by UserPrincipalName, IPAddress
  | where Prompts >= 3
  | sort by Prompts desc
tactics:
- CredentialAccess
queryPeriod: 1h
relevantTechniques:
- T1621
requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - SigninLogs
id: 284c73e0-3e14-4698-9202-36fcd458034e
kind: Scheduled
version: 1.0.0
description: |
  Identifies users with several AADSTS50074 (strong authentication required, the user did not pass the MFA challenge) or AADSTS500121 (authentication failed during the MFA challenge) sign-in results from the same IP address within one hour.
  One such row is often normal, for example a user who ignores a prompt once. A burst from an IP or country the user does not use can indicate MFA fatigue (an attacker with the password generating prompts), and a later successful sign-in from the same IP suggests the user approved a prompt they did not start.
  The threshold of 3 is a starting point, not a Microsoft number. Tune it against your own baseline.
  Each run looks at the last hour only, matching the hourly schedule, so one burst raises one alert and not one per run.
  Reference: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-interactive-sign-ins
status: InPreview
name: Repeated failed MFA challenges for one user from one IP (AADSTS50074 / AADSTS500121)

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/284c73e0-3e14-4698-9202-36fcd458034e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/284c73e0-3e14-4698-9202-36fcd458034e')]",
      "properties": {
        "alertRuleTemplateName": "284c73e0-3e14-4698-9202-36fcd458034e",
        "customDetails": null,
        "description": "Identifies users with several AADSTS50074 (strong authentication required, the user did not pass the MFA challenge) or AADSTS500121 (authentication failed during the MFA challenge) sign-in results from the same IP address within one hour.\nOne such row is often normal, for example a user who ignores a prompt once. A burst from an IP or country the user does not use can indicate MFA fatigue (an attacker with the password generating prompts), and a later successful sign-in from the same IP suggests the user approved a prompt they did not start.\nThe threshold of 3 is a starting point, not a Microsoft number. Tune it against your own baseline.\nEach run looks at the last hour only, matching the hourly schedule, so one burst raises one alert and not one per run.\nReference: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-interactive-sign-ins\n",
        "displayName": "Repeated failed MFA challenges for one user from one IP (AADSTS50074 / AADSTS500121)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserPrincipalName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/MFAPromptBurstFromSingleIP.yaml",
        "query": "SigninLogs\n| where TimeGenerated > ago(1h)\n| where ResultType in (\"50074\", \"500121\")\n| summarize Prompts = count(),\n            ResultTypes = make_set(ResultType),\n            FirstSeen = min(CreatedDateTime),\n            LastSeen = max(CreatedDateTime),\n            Apps = make_set(AppDisplayName, 5)\n          by UserPrincipalName, IPAddress\n| where Prompts >= 3\n| sort by Prompts desc\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "InPreview",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1621"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}