Failed Login Attempts

3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.

KQL Library  /  Analytics Rules

 Analytics Rules Failed Logins failed-login-attempts.kql

3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// This is the KQL behind an Analytics Rule I built for a demo to create alerts in Sentinel for 3 or more Failed Login Attempts in under 2 minutes. 
// The idea here was to create a logic app to trigger on this rule and disable/lockout the account.
// ErrorID 50126 is thrown when an invalid username or password is used: https://www.manageengine.com/products/active-directory-audit/kb/azure-error-codes/azure-ad-sign-in-error-code-50126.html

SigninLogs
| where ResultType == 50126
| summarize FailedAttempts = count() by UserPrincipalName, bin(TimeGenerated, 2m)
| where FailedAttempts >= 3