KQL Search

This query is designed to detect potential password spray attacks targeting Active Directory Federation Services (ADFS). Here's a simplified breakdown of what it does:

1. Purpose: The query identifies instances where a single IP address is causing multiple credential errors (like invalid passwords or locked accounts) across more than 10 different ADFS accounts within a 24-hour period. This pattern is indicative of a password spray attack, where an attacker tries common passwords across many accounts to avoid triggering lockouts.

2. Severity and Techniques: The severity of this detection is marked as "High," and it aligns with the MITRE ATT&CK technique T1110, which involves brute force attacks like password spraying.

3. Data Source: It uses data from Azure Active Directory, specifically the ADFSSignInLogs, to find these patterns.

4. Query Logic:

   • It looks at sign-in logs from the past day.
   • Filters for specific error codes that indicate credential failures.
   • Summarizes the data by counting distinct user accounts targeted by each IP address.
   • Checks if an IP address has targeted more than 10 accounts.
   • Orders the results by the number of accounts targeted.

5. Alerting: If the query finds any IP addresses meeting these criteria, it generates an alert. The alert includes details like the number of accounts targeted and the number of failed attempts, suggesting a possible password spray attack.

6. Incident Management: The system is configured to create an incident for each alert, grouping alerts by IP address to manage them efficiently.

Overall, this query helps security teams identify and respond to stealthy password spray attacks on ADFS systems by monitoring for suspicious login patterns from single IP addresses.