Account brute force (1)

id: 89cc68d2-1330-40ce-aaca-5c76fc4f52b3
name: Account brute force (1)
description: |
  Query #1: Look for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceLogonEvents
query: |
  // Query #2: Look for machines failing to log-on to multiple machines or using multiple accounts
  // Note - RemoteDeviceName is not available in all remote logon attempts
  DeviceLogonEvents
  | where isnotempty(RemoteDeviceName)
  | extend Account=strcat(AccountDomain, "\\", AccountName)
  | summarize 
      Successful=countif(ActionType == "LogonSuccess"),
      Failed = countif(ActionType == "LogonFailed"),
      FailedAccountsCount = dcountif(Account, ActionType == "LogonFailed"),
      SuccessfulAccountsCount = dcountif(Account, ActionType == "LogonSuccess"),
      FailedComputerCount = dcountif(DeviceName, ActionType == "LogonFailed"),
      SuccessfulComputerCount = dcountif(DeviceName, ActionType == "LogonSuccess")
      by RemoteDeviceName
  | where
      Successful > 0 and
      ((FailedComputerCount > 100 and FailedComputerCount > SuccessfulComputerCount) or
          (FailedAccountsCount > 100 and FailedAccountsCount > SuccessfulAccountsCount))