Azure Entra ID Password Spraying (Non-Interactive SFA)

  1[metadata]
  2creation_date = "2025/03/07"
  3integration = ["azure"]
  4maturity = "production"
  5min_stack_comments = "ES|QL not available until 8.13.0 in technical preview."
  6min_stack_version = "8.13.0"
  7updated_date = "2025/03/07"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies potential brute-force (password spraying) attempts against Azure Entra ID user accounts by detecting a high
 13number of failed non-interactive single-factor authentication (SFA) login attempts within a 10-minute window. Attackers
 14may attempt to brute force user accounts to gain unauthorized access to Azure Entra ID services. Non-interactive SFA
 15login attempts bypass conditional-access policies (CAP) and multi-factor authentication (MFA) requirements, making them
 16a high-risk vector for unauthorized access. Adversaries may attempt this to identify which accounts are still valid from
 17acquired credentials via phishing, infostealers, or other means.
 18"""
 19false_positives = [
 20    """
 21    Automated processes that attempt to authenticate using expired credentials or have misconfigured authentication
 22    settings may lead to false positives.
 23    """,
 24]
 25from = "now-30m"
 26interval = "10m"
 27language = "esql"
 28license = "Elastic License v2"
 29name = "Azure Entra ID Password Spraying (Non-Interactive SFA)"
 30note = """## Triage and analysis
 31
 32### Investigating Azure Entra ID Password Spraying (Non-Interactive SFA)
 33
 34This rule identifies repeated failed authentication attempts using non-interactive authentication, which is often leveraged for automated attacks or legacy authentication methods. Successful compromise of an account could lead to unauthorized access, privilege escalation, or lateral movement within the environment.
 35
 36**This is an ES|QL rule with aggregations that truncate results in the alert document. It is recommended to pivot investigation into the raw documents for further triage and analysis.**
 37
 38### Possible investigation steps
 39
 40- Identify the source IP address from which the failed login attempts originated by reviewing `source.ip`. Determine if the IP is associated with known malicious activity using threat intelligence sources or if it belongs to a corporate VPN, proxy, or automation process.
 41- Analyze affected user accounts by reviewing `azure.signinlogs.properties.user_principal_name` to determine if they belong to privileged roles or high-value users. Look for patterns indicating multiple failed attempts across different users, which could suggest a password spraying attempt.
 42- Examine the authentication method used in `azure.signinlogs.properties.authentication_details` to identify which authentication protocols were attempted and why they failed. Legacy authentication methods may be more susceptible to brute-force attacks.
 43- Review the authentication error codes found in `azure.signinlogs.properties.status.error_code` to understand why the login attempts failed. Common errors include `50126` for invalid credentials, `50053` for account lockouts, `50055` for expired passwords, and `50056` for users without a password.
 44- Correlate failed logins with other sign-in activity by looking at `event.outcome`. Identify if there were any successful logins from the same user shortly after multiple failures or if there are different geolocations or device fingerprints associated with the same account.
 45- Review `azure.signinlogs.properties.app_id` to identify which applications were initiating the authentication attempts. Determine if these applications are Microsoft-owned, third-party, or custom applications and if they are authorized to access the resources.
 46- Check for any conditional access policies that may have been triggered by the failed login attempts by reviewing `azure.signinlogs.properties.authentication_requirement`. This can help identify if the failed attempts were due to policy enforcement or misconfiguration.
 47
 48## False positive analysis
 49
 50### Common benign scenarios
 51- Automated scripts or applications using non-interactive authentication may trigger this detection, particularly if they rely on legacy authentication protocols recorded in `azure.signinlogs.properties.authentication_protocol`.
 52- Corporate proxies or VPNs may cause multiple users to authenticate from the same IP, appearing as repeated failed attempts under `source.ip`.
 53- User account lockouts from forgotten passwords or misconfigured applications may show multiple authentication failures in `azure.signinlogs.properties.status.error_code`.
 54
 55### How to reduce false positives
 56- Exclude known trusted IPs, such as corporate infrastructure, from alerts by filtering `source.ip`.
 57- Exlcude known custom applications from `azure.signinlogs.properties.app_id` that are authorized to use non-interactive authentication.
 58- Ignore principals with a history of failed logins due to legitimate reasons, such as expired passwords or account lockouts, by filtering `azure.signinlogs.properties.user_principal_name`.
 59- Correlate sign-in failures with password reset events or normal user behavior before triggering an alert.
 60
 61## Response and remediation
 62
 63### Immediate actions
 64- Block the source IP address in `source.ip` if determined to be malicious.
 65- Reset passwords for all affected user accounts listed in `azure.signinlogs.properties.user_principal_name` and enforce stronger password policies.
 66- Ensure basic authentication is disabled for all applications using legacy authentication protocols listed in `azure.signinlogs.properties.authentication_protocol`.
 67- Enable multi-factor authentication (MFA) for impacted accounts to mitigate credential-based attacks.
 68- Review conditional access policies to ensure they are correctly configured to block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
 69- Review Conditional Access policies to enforce risk-based authentication and block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
 70
 71### Long-term mitigation
 72- Implement a zero-trust security model by enforcing least privilege access and continuous authentication.
 73- Regularly review and update conditional access policies to ensure they are effective against evolving threats.
 74- Restrict the use of legacy authentication protocols by disabling authentication methods listed in `azure.signinlogs.properties.client_app_used`.
 75- Regularly audit authentication logs in `azure.signinlogs` to detect abnormal login behavior and ensure early detection of potential attacks.
 76- Regularly rotate client credentials and secrets for applications using non-interactive authentication to reduce the risk of credential theft.
 77"""
 78references = [
 79    "https://securityscorecard.com/wp-content/uploads/2025/02/MassiveBotnet-Report_022125_03.pdf"
 80]
 81risk_score = 47
 82rule_id = "cca64114-fb8b-11ef-86e2-f661ea17fbce"
 83severity = "medium"
 84tags = [
 85    "Domain: Cloud",
 86    "Data Source: Azure",
 87    "Data Source: Entra ID",
 88    "Data Source: Entra ID Sign-in",
 89    "Use Case: Identity and Access Audit",
 90    "Use Case: Threat Detection",
 91    "Tactic: Credential Access",
 92    "Resources: Investigation Guide",
 93]
 94timestamp_override = "event.ingested"
 95type = "esql"
 96
 97query = '''
 98from logs-azure.signinlogs*
 99| keep
100    @timestamp,
101    event.dataset,
102    event.category,
103    azure.signinlogs.properties.is_interactive,
104    azure.signinlogs.properties.authentication_requirement,
105    azure.signinlogs.properties.resource_display_name,
106    azure.signinlogs.properties.status.error_code,
107    azure.signinlogs.properties.resource_service_principal_id,
108    azure.signinlogs.category,
109    event.outcome,
110    azure.signinlogs.properties.user_principal_name,
111    source.ip
112// truncate the timestamp to a 10-minute window
113| eval target_time_window = DATE_TRUNC(10 minutes, @timestamp)
114| WHERE
115  event.dataset == "azure.signinlogs"
116  and event.category == "authentication"
117  and azure.signinlogs.properties.is_interactive == false
118  and azure.signinlogs.properties.authentication_requirement == "singleFactorAuthentication"
119  and event.outcome != "success"
120  and azure.signinlogs.properties.status.error_code in (50053, 50126, 50055, 50056, 50064, 50144)
121    // for tuning review azure.signinlogs.properties.status.error_code
122    // https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
123
124// count the number of unique user login attempts
125| stats
126    unique_user_login_count = count_distinct(azure.signinlogs.properties.resource_service_principal_id) by
127        target_time_window,
128        azure.signinlogs.properties.user_principal_name,
129        azure.signinlogs.properties.status.error_code
130
131// filter for >= 20 failed SFA auth attempts with the same error codes
132| where unique_user_login_count >= 20
133'''
134
135
136[[rule.threat]]
137framework = "MITRE ATT&CK"
138[[rule.threat.technique]]
139id = "T1110"
140name = "Brute Force"
141reference = "https://attack.mitre.org/techniques/T1110/"
142[[rule.threat.technique.subtechnique]]
143id = "T1110.003"
144name = "Password Spraying"
145reference = "https://attack.mitre.org/techniques/T1110/003/"
146
147
148
149[rule.threat.tactic]
150id = "TA0006"
151name = "Credential Access"
152reference = "https://attack.mitre.org/tactics/TA0006/"