Identifying Suspicious Successful Sign-Ins In Entra ID With Sentinel & Defender XDR

Threat Overview

From an identity security perspective, brute force attacks have evolved beyond noisy and obvious failure patterns. Modern attackers operate patiently, rotate infrastructure, abuse legacy authentication flows, and attempt to blend into normal sign-in behavior to avoid detection.

Microsoft Entra ID provides rich authentication telemetry, but attackers often exploit monitoring gaps. Non-interactive sign-ins, SMTP authentication, and protocol-based access can bypass modern client protections. In many investigations, defenders only see suspicious behavior after access has already been obtained.

The highest-risk scenarios typically include:

• A password being entered correctly
• The sign-in originating from an unfamiliar or malicious IP address
• An account that was recently locked due to repeated failures

These conditions strongly indicate a brute force campaign that has moved from attempted access to potential compromise.

Detection Logic Explained

Intent

The detection logic is designed to:

• Identify authentication attempts where a correct password is used under suspicious conditions
• Detect early indicators of successful brute force activity before attackers exploit access
• Reduce reliance on alerts driven solely by failed sign-ins

Signal Selection

The detection leverages Entra ID sign-in telemetry from both interactive and non-interactive logs. It focuses on authentication events associated with risk indicators such as malicious IP classifications, account lockouts, and legacy authentication protocols. Recent activity is evaluated in the context of historical behavior.

Allow-List and Baseline Design

A historical baseline of IP addresses that successfully authenticated over the past 14 days is established. When a sign-in originates from an IP address not observed during that period, it is treated as higher risk if additional suspicious indicators are present.

This approach allows the detection to adapt naturally to normal user behavior while still highlighting meaningful anomalies.

Behavioral Rationale

Instead of alerting on every authentication failure, this logic looks for signs of success occurring in the wrong context, including:

• Correct passwords originating from malicious or unfamiliar infrastructure
• Successful authentication attempts against accounts already under attack or locked
• SMTP or legacy protocol access following repeated authentication failures

In practice, this behavior-focused approach produces higher-quality signals and improves analyst confidence during triage.

KQL Query Used

The query analyzes recent authentication activity and identifies several high-risk scenarios:

• Correct password usage from IPs flagged as malicious.
• Successful authentication attempts against locked accounts.
• Possible successful brute force attempts using SMTP or legacy authentication flows.
• All results are filtered to exclude IP addresses previously observed in successful sign-ins.

The output is a consolidated view of potentially compromised authentication events that warrant immediate investigation.

let PreviouslyUsedIP = SigninLogs 
    | union AADNonInteractiveUserSignInLogs 
    | where TimeGenerated between (ago(14d) .. ago(1h)) 
    | where ResultType == 0 
    | distinct IPAddress; 

let MaliciousIPSignin = SigninLogs 
    | union AADNonInteractiveUserSignInLogs 
    | where TimeGenerated > ago(1h) // Rule Frequency 
    | where ResultType == 50053 
    | where ResultDescription contains "malicious activity" 
    | extend PasswordStatus = tostring(parse_json(AuthenticationDetails)[0].authenticationStepResultDetail)  
    | extend PasswordEnteredCorrectly = tostring(parse_json(AuthenticationDetails)[0].succeeded) 
    | where PasswordStatus == "Correct password" or PasswordEnteredCorrectly contains "true" 
    | extend Case = "Malicious IP Address" 
    | project 
        Case, 
        PasswordStatus, 
        PasswordEnteredCorrectly, 
        TimeGenerated, 
        UserPrincipalName, 
        IPAddress, 
        Location, 
        AppDisplayName, 
        ResultType, 
        ResultDescription, 
        Status_dynamic, 
        Status_string, 
        AuthenticationDetails, 
        RiskEventTypes, 
        RiskEventTypes_V2, 
        ClientAppUsed, 
        AuthenticationProtocol, 
        UserAgent, 
        DeviceDetail_dynamic, 
        DeviceDetail_string 
    | join kind=leftanti PreviouslyUsedIP on IPAddress; 

let CorrectPasswordLockedAccount = SigninLogs 
    | union AADNonInteractiveUserSignInLogs 
    | where TimeGenerated > ago(1h) // Rule Frequency 
    | where ResultType == 50053 
    | where ResultDescription contains "Account is locked" 
    | extend PasswordStatus = tostring(parse_json(AuthenticationDetails)[0].authenticationStepResultDetail)  
    | extend PasswordEnteredCorrectly = tostring(parse_json(AuthenticationDetails)[0].succeeded) 
    | where PasswordStatus == "Correct password" or PasswordEnteredCorrectly contains "true" 
    | extend Case = "Successful Password on a Locked Account" 
    | project 
        Case, 
        PasswordStatus, 
        PasswordEnteredCorrectly, 
        TimeGenerated, 
        UserPrincipalName, 
        IPAddress, 
        Location, 
        AppDisplayName, 
        ResultType, 
        ResultDescription, 
        Status_dynamic, 
        Status_string, 
        AuthenticationDetails, 
        RiskEventTypes, 
        RiskEventTypes_V2, 
        ClientAppUsed, 
        AuthenticationProtocol, 
        UserAgent, 
        DeviceDetail_dynamic, 
        DeviceDetail_string 
    | join kind=leftanti PreviouslyUsedIP on IPAddress; 

let SMTPBruteForceUsers = SigninLogs 
    | union AADNonInteractiveUserSignInLogs 
    | where TimeGenerated > ago(1h) // Rule Frequency 
    | where ResultType in (50053, 50126) 
    | where ClientAppUsed == "Authenticated SMTP" 
        or AuthenticationProtocol == "ropc" 
        or UserAgent == "BAV2ROPC"  
    | summarize FailureCount = count() by UserPrincipalName 
    | where FailureCount > 2; // Change value to tune 

let PossibleSuccessSMTPBruteForce = SigninLogs 
    | union AADNonInteractiveUserSignInLogs 
    | where TimeGenerated > ago(1h) // Rule Frequency 
    | join kind=inner SMTPBruteForceUsers on UserPrincipalName 
    | extend PasswordStatus = tostring(parse_json(AuthenticationDetails)[0].authenticationStepResultDetail)  
    | extend PasswordEnteredCorrectly = tostring(parse_json(AuthenticationDetails)[0].succeeded) 
    | where (PasswordStatus == "Correct password" or PasswordEnteredCorrectly contains "true") 
        or (ResultType notin (50126, 50053)) 
    | where ClientAppUsed == "Authenticated SMTP" 
        or AuthenticationProtocol == "ropc" 
        or UserAgent == "BAV2ROPC" 
    | extend Case = "Possible Successful SMTP Brute Force" 
    | project 
        Case, 
        TimeGenerated, 
        UserPrincipalName, 
        IPAddress, 
        Location, 
        AppDisplayName, 
        ResultType, 
        ResultDescription, 
        Status_dynamic, 
        Status_string, 
        AuthenticationDetails, 
        RiskEventTypes, 
        RiskEventTypes_V2, 
        ClientAppUsed, 
        AuthenticationProtocol, 
        UserAgent, 
        DeviceDetail_dynamic, 
        DeviceDetail_string 
    | join kind=leftanti PreviouslyUsedIP on IPAddress; 

PossibleSuccessSMTPBruteForce 
| union MaliciousIPSignin 
| union CorrectPasswordLockedAccount 
| extend DeviceOS = tostring(parse_json(DeviceDetail_dynamic).operatingSystem) 

Discover blogs that deepen your knowledge and accelerate your security strategy.