KQL Search

//Detect when a user who holds an Azure AD privilege role fails MFA multiple times in a short time period. This example uses 2 failures within 20 minutes.

//Data connector required for this query - Azure Active Directory - Signin Logs
//Data connector required for this query - Microsoft Sentinel UEBA

let privusers=
    IdentityInfo
    | where TimeGenerated > ago(21d)
    | summarize arg_max(TimeGenerated, *) by AccountUPN
    | where isnotempty(AssignedRoles)
    | where AssignedRoles != "[]"
    | distinct AccountUPN;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "500121"
| where UserPrincipalName in (privusers)
| mv-expand todynamic(AuthenticationDetails)
| extend ['MFA Failure Type'] = tostring(parse_json(AuthenticationDetails).authenticationStepResultDetail)
| where ['MFA Failure Type'] startswith "MFA denied"
| summarize
    ['MFA Failure Count']=count(),
    ['MFA Failure Reasons']=make_list(['MFA Failure Type'])
    by UserPrincipalName, bin(TimeGenerated, 20m)
| where ['MFA Failure Count'] >= 2