Failed Login Attempts

3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.

KQL Library  /  Analytics Rules

 Analytics Rules Failed Logins failed-login-attempts.kql

3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.

Tactics Credential Access
Techniques T1110.001 T1110.003
Platforms Entra ID
Data SigninLogs
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// This is the KQL behind an Analytics Rule I built for a demo to create alerts in Sentinel for 3 or more Failed Login Attempts in under 2 minutes. 
// The idea here was to create a logic app to trigger on this rule and disable/lockout the account.
// ErrorID 50126 is thrown when an invalid username or password is used: https://www.manageengine.com/products/active-directory-audit/kb/azure-error-codes/azure-ad-sign-in-error-code-50126.html
// Source: Logic Apps & Automation (2024-08-16) — https://www.hanley.cloud/2024-08-16-Logic-Apps-%26-Automation/
// Tactics: Credential Access
// Techniques: T1110.001, T1110.003
// Platforms: Entra ID
// Data: SigninLogs

SigninLogs
| where ResultType == 50126
| summarize FailedAttempts = count() by UserPrincipalName, bin(TimeGenerated, 2m)
| where FailedAttempts >= 3