Skip to content

[Rule Tuning] Add exceptions for non-interactive signin failures for Entra M365 Bruteforce #4405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 10 commits into
base: main
Choose a base branch
from
+5 −1
Open

[Rule Tuning] Add exceptions for non-interactive signin failures for Entra M365 Bruteforce #4405

Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
e1dcce1
Add exceptions for non-interactive signin failures.
jvalente-salemstate Jan 21, 2025
be57a17
Merge branch 'main' into azure_entra_signin_bruteforce_m365-tune
terrancedejesus Feb 20, 2025
55fc186
Merge branch 'main' into azure_entra_signin_bruteforce_m365-tune
terrancedejesus Mar 15, 2025
9fc2215
Merge branch 'main' into azure_entra_signin_bruteforce_m365-tune
Samirbous Apr 3, 2025
35427d1
Merge branch 'main' into azure_entra_signin_bruteforce_m365-tune
Mikaayenson Apr 3, 2025
8eac1b9
Update rules/integrations/azure/credential_access_entra_signin_brute_…
Mikaayenson Apr 3, 2025
2c964a3
Update metadata for `updated_date`
jvalente-salemstate Apr 18, 2025
f99e0aa
Merge branch 'main' into azure_entra_signin_bruteforce_m365-tune
terrancedejesus Apr 18, 2025
91a7745
Merge branch 'main' into azure_entra_signin_bruteforce_m365-tune
terrancedejesus Apr 24, 2025
32b0b37
Merge branch 'main' into azure_entra_signin_bruteforce_m365-tune
terrancedejesus Apr 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion rules/integrations/azure/credential_access_entra_signin_brute_force_microsoft_365.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
creation_date = "2024/09/06"
integration = ["azure"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/04/18"


[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -91,6 +92,9 @@ from logs-azure.signinlogs*
and to_lower(azure.signinlogs.properties.resource_display_name) rlike "(.*)365(.*)"
and azure.signinlogs.category in ("NonInteractiveUserSignInLogs", "SignInLogs")
and event.outcome != "success"
and not (azure.signinlogs.category == "NonInteractiveUserSignInLogs"
and azure.signinlogs.properties.status.error_code in (70043, 70044, 50057)
and azure.signinlogs.properties.incoming_token_type in ("primaryRefreshToken", "refreshToken"))
// for tuning review azure.signinlogs.properties.status.error_code
// https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes

Expand Down
Loading