Login attempt by Blocked MFA user

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


An account could be blocked if there are too many failed authentication attempts in a row. This hunting query identifies if a MFA user account that is set to blocked tries to login to Microsoft Entra ID. This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.

Attribute Value
Type Hunting Query
Solution Standalone Content
ID 75fd68a2-9ed4-4a1c-8bd7-18efe4c99081
Tactics InitialAccess
Techniques T1078
Required Connectors AzureActiveDirectory, BehaviorAnalytics, BehaviorAnalytics
Source [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/SigninLogs/MFAUserBlocked.yaml)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Hunting Queries