← Back to SOC feed Coverage →

Privileged Accounts - Failed MFA

kql MEDIUM Azure-Sentinel
T1078.004
AADNonInteractiveUserSignInLogsIdentityInfoSigninLogs
backdoorhuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-06-02T11:00:00Z · Confidence: medium

Hunt Hypothesis

Failed MFA attempts from privileged accounts may indicate an adversary attempting to compromise these accounts to gain unauthorized access. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential credential theft or lateral movement tactics early.

KQL Query

let starttime = todatetime('{{StartTimeISO}}');
let endtime = todatetime('{{EndTimeISO}}');
let aadFunc = (tableName:string){
IdentityInfo
| where AssignedRoles contains "Admin"
| mv-expand AssignedRoles
| extend Roles = tostring(AssignedRoles), AccountUPN = tolower(AccountUPN)
| where Roles contains "Admin"
| distinct Roles, AccountUPN
| join kind=inner (
  // Failed Signins attempts with reasoning related to MFA.
  table(tableName)
  | where TimeGenerated between(starttime..endtime)
  | where ResultDescription has_any ("MFA", "second factor", "multi-factor", "second factor") or ResultType in (50074, 50076, 50079, 50072, 53004, 500121)
) on $left.AccountUPN == $right.UserPrincipalName
| extend timestamp = TimeGenerated, IPCustomEntity = IPAddress, AccountCustomEntity = UserPrincipalName
};
let aadSignin = aadFunc("SigninLogs");
let aadNonInt = aadFunc("AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt

Analytic Rule Definition

id: d9524fcf-de06-4f95-84b0-1637a30ad595
name: Privileged Accounts - Failed MFA
description: |
  ' Identifies failed MFA attempts from Privileged accounts. Privileged accounts list can be based on IdentityInfo UEBA table or built-in watchlist.
  Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AADNonInteractiveUserSignInLogs
  - connectorId: BehaviorAnalytics
    dataTypes:
      - IdentityInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1078.004
tags:
  - AADSecOpsGuide
query: |
  let starttime = todatetime('{{StartTimeISO}}');
  let endtime = todatetime('{{EndTimeISO}}');
  let aadFunc = (tableName:string){
  IdentityInfo
  | where AssignedRoles contains "Admin"
  | mv-expand AssignedRoles
  | extend Roles = tostring(AssignedRoles), AccountUPN = tolower(AccountUPN)
  | where Roles contains "Admin"
  | distinct Roles, AccountUPN
  | join kind=inner (
    // Failed Signins attempts with reasoning related to MFA.
    table(tableName)
    | where TimeGenerated between(starttime..endtime)
    | where ResultDescription has_any ("MFA", "second factor", "multi-factor", "second factor") or ResultType in (50074, 50076, 50079, 50072, 53004, 500121)
  ) on $left.AccountUPN == $right.UserPrincipalName
  | extend timestamp = TimeGenerated, IPCustomEntity = IPAddress, AccountCustomEntity = UserPrincipalName
  };
  let aadSignin = aadFunc("SigninLogs");
  let aadNonInt = aadFunc("AADNonInteractiveUserSignInLogs");
  union isfuzzy=true aadSignin, aadNonInt
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.1

Required Data Sources

Sentinel TableNotes
AADNonInteractiveUserSignInLogsEnsure this data connector is enabled
IdentityInfoEnsure this data connector is enabled
SigninLogsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/MultipleDataSources/AADPrivilegedAccountsFailedMFA.yaml