Entra sign-in brute force
Repeated failed cloud sign-ins from one source IP against a single user within a short window — brute force or password guessing against cloud identity.
What it detects
Repeated failed cloud sign-ins from one source IP against a single user within a short window — brute force or password guessing against cloud identity. Matches on the SIGNAL (an application-platform authentication failure) rather than a single provider label, so it fires on Entra ID / Azure AD, Exchange Online legacy auth, and any other cloud identity source — including IPv6 clients. KIROSEC's top detection priority (suspicious login activity), extended to the cloud control plane. The specific workload (Exchange, SharePoint, AzureActiveDirectory, …) is preserved on each event for filtering and workload-specific rules.
MITRE ATT&CK mapping
- T1110Brute Force· Credential Access
False positives and triage
A misconfigured client or an expired password can cluster failures for one user. Judge by the sign-in error code, the source IP reputation, and whether a successful sign-in follows the burst (possible account takeover).
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/cloud/entra_signin_brute_force.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_signin_brute_force
version: 1.0.0
status: stable
severity: high
confidence: 0.85
platforms: [application]
mitre_techniques: [T1110]
description: |
Repeated failed cloud sign-ins from one source IP against a single user within a
short window — brute force or password guessing against cloud identity. Matches
on the SIGNAL (an application-platform authentication failure) rather than a
single provider label, so it fires on Entra ID / Azure AD, Exchange Online legacy
auth, and any other cloud identity source — including IPv6 clients. KIROSEC's top
detection priority (suspicious login activity), extended to the cloud control
plane. The specific workload (Exchange, SharePoint, AzureActiveDirectory, …) is
preserved on each event for filtering and workload-specific rules.
match:
platform: application
event_category: authentication
event_outcome: failure
threshold:
count: 5
window_seconds: 600
group_by: [source_ip, user_name]
correlation_keys: [source_ip:user_name]
false_positive_guidance: |
A misconfigured client or an expired password can cluster failures for one user.
Judge by the sign-in error code, the source IP reputation, and whether a
successful sign-in follows the burst (possible account takeover).
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.