KQL Search

This query is designed to detect potential brute force attacks on Active Directory Federation Services (ADFS). It looks for patterns where a user account experiences more than five failed login attempts due to specific error codes associated with brute force attempts, followed by a successful login. The successful login must occur after the last failed attempt, indicating that the attacker may have guessed the correct password.

Here's a simple breakdown of what the query does:

1. Identify Failed Attempts: It checks the ADFS sign-in logs for the past day to find failed login attempts with specific error codes that suggest brute force attacks. It counts these failures and notes the last failure time and the IP addresses used.

2. Identify Successful Logins: It then looks for successful logins (where the result type is 0) within the same timeframe and records the time of the first successful login and the IP address used.

3. Match Failures to Success: The query matches users who had more than five failed attempts with a subsequent successful login. It ensures the successful login happened after the last failed attempt.

4. Analyze and Alert: If such a pattern is found, it generates an alert indicating a potential account compromise. The alert includes details like the number of failed attempts, the time difference between the last failure and the first success, and the IP addresses involved.

5. Incident Management: The query is set to create an incident if such an alert is triggered, grouping alerts by account to manage potential compromises effectively.

Overall, this query helps security teams identify and respond to potential brute force attacks that result in successful unauthorized access to user accounts.