Skip to content

Commit c7c1586

Browse files
[Rule Deprecation] Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source (#4780)
* rule deprecation * adjusted investigation guide
1 parent 9569aa4 commit c7c1586

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

rules/integrations/azure/credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2024/09/06"
33
integration = ["azure"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/06/06"
66

77
[rule]
88
author = ["Elastic"]
@@ -22,13 +22,13 @@ from = "now-30m"
2222
interval = "10m"
2323
language = "esql"
2424
license = "Elastic License v2"
25-
name = "Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source"
25+
name = "Deprecated - Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source"
2626
note = """## Triage and analysis
2727
2828
> **Disclaimer**:
2929
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
3030
31-
### Investigating Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source
31+
### Investigating Deprecated - Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source
3232
3333
Azure Entra ID, integral to Microsoft 365, manages identity and access, ensuring secure authentication. Adversaries exploit this by attempting numerous failed logins to breach accounts. The detection rule identifies such brute-force attempts by monitoring failed logins from a single IP within a short timeframe, flagging potential unauthorized access efforts.
3434

0 commit comments

Comments
 (0)