Failed Logon Attempt

Description

Sample query to detect If there are more then 3 failed logon authentications on high value assets. Update DeviceName to reflect your high value assets. For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com.

Query · kql

DeviceLogonEvents
| where DeviceName in ("DeviceName1","DeviceName2")
| where ActionType == "LogonFailed"
| summarize LogonFailures=count() by DeviceName, LogonType, InitiatingProcessCommandLine
| where LogonFailures > 3
| project LogonFailures, DeviceName, LogonType, InitiatingProcessCommandLine
| sort by LogonFailures desc
Raw source Failed Logon Attempt · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 95d68a9c-91d3-41ce-ab9f-f1baadc74f8a
name: Failed Logon Attempt
description: |
  Sample query to detect If there are more then 3 failed logon authentications on high value assets.
  Update DeviceName to reflect your high value assets.
  For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceLogonEvents
query: |
  DeviceLogonEvents
  | where DeviceName in ("DeviceName1","DeviceName2")
  | where ActionType == "LogonFailed"
  | summarize LogonFailures=count() by DeviceName, LogonType, InitiatingProcessCommandLine
  | where LogonFailures > 3
  | project LogonFailures, DeviceName, LogonType, InitiatingProcessCommandLine
  | sort by LogonFailures desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.