MFA Spamming followed by Successful login

Back


Id	a8cc6d5c-4e7e-4b48-b4ac-d8a116c62a8b
Rulename	MFA Spamming followed by Successful login
Description	Identifies MFA Spamming followed by Successful logins and by a successful authentication within a given time window. Default Failure count is 10 and 1 successful login with default Time Window is 5 minutes.
Severity	High
Tactics	CredentialAccess
Techniques	T1110
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/MFASpammingfollowedbySuccessfullogin.yaml
Version	1.0.4
Arm template	a8cc6d5c-4e7e-4b48-b4ac-d8a116c62a8b.json

KQL

// Filter for sign-in logs ingested within the last day
SigninLogs
| where ingestion_time() > ago(1d)
// Filter for records with AuthenticationRequirement set to multiFactorAuthentication
| where AuthenticationRequirement == "multiFactorAuthentication"
// Extract information from dynamic columns DeviceDetail and LocationDetails
| extend DeviceDetail = todynamic(DeviceDetail), LocationDetails = todynamic(LocationDetails)
// Extract specific attributes from DeviceDetail and LocationDetails
| extend
      OS = tostring(DeviceDetail.operatingSystem),
      Browser = tostring(DeviceDetail.browser),
      State = tostring(LocationDetails.state),
      City = tostring(LocationDetails.city),
      Region = tostring(LocationDetails.countryOrRegion)
// Expand multi-value property AuthenticationDetails into separate records
| mv-expand todynamic(AuthenticationDetails)
// Parse AuthResult from JSON in AuthenticationDetails and convert to string
| extend AuthResult = tostring(parse_json(AuthenticationDetails).authenticationStepResultDetail)
// Summarize data by aggregating statistics for each user, IP, and AuthResult
| summarize FailedAttempts = countif(AuthResult == "MFA denied; user declined the authentication" or AuthResult == "MFA denied; user did not respond to mobile app notification"), SuccessfulAttempts = countif(AuthResult == "MFA successfully completed"), InvolvedOS = make_set(OS, 5), InvolvedBrowser = make_set(Browser), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserPrincipalName, IPAddress, State, City, Region
// Calculate AuthenticationWindow by finding time difference between start and end times
| extend AuthenticationWindow = (EndTime - StartTime)
// Filter for records with more than 10 failed attempts in 5-minute window and at least 1 successful attempt
| where FailedAttempts > 10 and AuthenticationWindow <= 5m and SuccessfulAttempts >= 1
// Extract user's name and UPN suffix using split function
| extend Name = tostring(split(UserPrincipalName, '@', 0)[0]), UPNSuffix = tostring(split(UserPrincipalName, '@', 1)[0])

YAML

requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - SigninLogs
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/MFASpammingfollowedbySuccessfullogin.yaml
triggerThreshold: 0
status: Available
relevantTechniques:
- T1110
queryPeriod: 1d
name: MFA Spamming followed by Successful login
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserPrincipalName
    identifier: FullName
  - columnName: Name
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
- entityType: IP
  fieldMappings:
  - columnName: IPAddress
    identifier: Address
queryFrequency: 1d
triggerOperator: gt
kind: Scheduled
description: |
  'Identifies MFA Spamming followed by Successful logins and by a successful authentication within a given time window.
  Default Failure count is 10 and 1 successful login with default Time Window is 5 minutes.'  
tactics:
- CredentialAccess
severity: High
version: 1.0.4
query: |
  // Filter for sign-in logs ingested within the last day
  SigninLogs
  | where ingestion_time() > ago(1d)
  // Filter for records with AuthenticationRequirement set to multiFactorAuthentication
  | where AuthenticationRequirement == "multiFactorAuthentication"
  // Extract information from dynamic columns DeviceDetail and LocationDetails
  | extend DeviceDetail = todynamic(DeviceDetail), LocationDetails = todynamic(LocationDetails)
  // Extract specific attributes from DeviceDetail and LocationDetails
  | extend
        OS = tostring(DeviceDetail.operatingSystem),
        Browser = tostring(DeviceDetail.browser),
        State = tostring(LocationDetails.state),
        City = tostring(LocationDetails.city),
        Region = tostring(LocationDetails.countryOrRegion)
  // Expand multi-value property AuthenticationDetails into separate records
  | mv-expand todynamic(AuthenticationDetails)
  // Parse AuthResult from JSON in AuthenticationDetails and convert to string
  | extend AuthResult = tostring(parse_json(AuthenticationDetails).authenticationStepResultDetail)
  // Summarize data by aggregating statistics for each user, IP, and AuthResult
  | summarize FailedAttempts = countif(AuthResult == "MFA denied; user declined the authentication" or AuthResult == "MFA denied; user did not respond to mobile app notification"), SuccessfulAttempts = countif(AuthResult == "MFA successfully completed"), InvolvedOS = make_set(OS, 5), InvolvedBrowser = make_set(Browser), StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserPrincipalName, IPAddress, State, City, Region
  // Calculate AuthenticationWindow by finding time difference between start and end times
  | extend AuthenticationWindow = (EndTime - StartTime)
  // Filter for records with more than 10 failed attempts in 5-minute window and at least 1 successful attempt
  | where FailedAttempts > 10 and AuthenticationWindow <= 5m and SuccessfulAttempts >= 1
  // Extract user's name and UPN suffix using split function
  | extend Name = tostring(split(UserPrincipalName, '@', 0)[0]), UPNSuffix = tostring(split(UserPrincipalName, '@', 1)[0])  
id: a8cc6d5c-4e7e-4b48-b4ac-d8a116c62a8b

ARM