# T1110 - Brute Force

## SOC Recommendation
Correlate authentication failure volume and pattern (single account / many sources vs. many accounts / single or few sources) with any subsequent successful sign-in. Treat a success that follows a brute force or spray pattern as likely compromise until proven otherwise, regardless of whether the account itself looks privileged.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Connection Attempt Analysis | Detect | Review failed sign-in bursts, password spray patterns across many accounts from a small set of sources, and any success immediately following a failure streak. |
| Strong Password Policy | Harden | Confirm lockout thresholds, smart lockout, and banned-password lists are enforced; tighten where legacy or service accounts are exempt. |
| Multi-factor Authentication | Harden | Confirm MFA is enforced for the affected account and that legacy authentication protocols (which bypass MFA) are blocked. |
| Credential Revocation | Evict | Revoke sessions and refresh tokens if a spray attempt succeeded. |

## Investigation Steps
1. Review Entra ID SigninLogs for the affected account(s) and source IPs over the last 24-48 hours.
2. Check Identity Protection risky sign-ins and risky users for spray/brute-force risk detections.
3. Review whether legacy authentication (IMAP/POP/SMTP AUTH) was used to bypass MFA.
4. Check Conditional Access sign-in diagnostics for any policy that was not applied or was misconfigured.
5. Confirm smart lockout / custom lockout thresholds are active for the tenant.

## Evidence to Collect
- Target username(s)
- Source IP(s) and ASN
- Authentication protocol used
- Failure count and time window
- Any successful sign-in following failures
- MFA challenge result, if any
- User agent / client app

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block attacking IPs in Conditional Access (Named Locations → | Medium | No | Yes |
| Reset passwords for all accounts successfully authenticated | Medium | No | Yes |
| Force MFA for targeted accounts if not already enforced | Low | No | Yes |
| Alert customer — provide list of targeted and compromised ac | Low | No | Yes |

## KQL
```kql
let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where (UriPath has "/api/register" or UriPath has "/api/reset") and Status == 403;
let recCount = iff((toscalar(firstRec | count) >= 20), 1, 0);
firstRec | take recCount
```
```kql
let loginRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login?user=" and Status == 403;
let recCount = iff((toscalar(loginRec | count) > 10), 1, 0);
loginRec | take recCount
```
```kql
let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login?user=" and Status in (200, 403);
let ipAddressCount = toscalar(firstRec | summarize by SourceIp | count);
let secondRec = firstRec | summarize arg_max(TimeGenerated, *) by SourceIp;
let recCount = iff((toscalar(secondRec | count) > 3), ipAddressCount, 0);
secondRec | take recCount
```

## Escalation Criteria
- A spray or brute-force attempt succeeded.
- Privileged or break-glass account targeted.
- Source IP associated with known threat infrastructure.
- Legacy authentication protocol was used to bypass MFA.
- Attempts continue after initial containment.

## False Positive Considerations
- Misconfigured service account with wrong password — Single account pattern — rule threshold of 5+ accounts won't trigger

Generated by SOC Response Atlas by Basyrix.