name: O365 Excessive SSO logon errors
id: 8158ccc4-6038-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: batch
datamodel: []
description: This search detects accounts with high number of Single Sign ON (SSO)
  logon errors. Excessive logon errors may indicate attempts to bruteforce of password
  or single sign on token hijack or reuse.
search: '`o365_management_activity`  Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired
  | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress
  UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `o365_excessive_sso_logon_errors_filter`'
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
  works with o365:management:activity
known_false_positives: Logon errors may not be malicious in nature however it may
  indicate attempts to reuse a token or password obtained via credential access attack.
references:
- https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/
tags:
  analytic_story:
  - Office 365 Detections
  - Cloud Federated Credential Abuse
  asset_type: Office 365
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json
  kill_chain_phases:
  - Actions on Objective
  mitre_attack_id:
  - T1556
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Workload
  - LogonError
  - ActorIpAddress
  - UserAgent
  - UserId
  security_domain: threat
