MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1110Brute Force

Credential Access

View on MITRE ATT&CK →

2 Queries

Brute Force Against Single Account

mediumproductionMicrosoft Sentinel

Microsoft Entra ID·SigninLogs

let FailThreshold = 10;
let TimeWindow = 15m;
SigninLogs
| where TimeGenerated > ago(1d)
| summarize FailCount = countif(ResultType != 0), SuccessCount = countif(ResultType == 0), IPAddresses = make_set(IPAddress) by UserPrincipalName, bin(TimeGenerated, TimeWindow)
| where FailCount >= FailThreshold and SuccessCount >= 1
| sort by FailCount desc

triathIC · last tested 2025-03-01

attack.mitre.org
learn.microsoft.com

Tuning notes

Adjust FailThreshold based on org size. Service accounts with misconfigured passwords may trigger false positives — consider excluding them by UPN pattern.

+ Add another query for this technique →