splunk_escuAnomaly

O365 Excessive SSO logon errors

The following analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors. It leverages data from the `o365_management_activity` dataset, focusing on failed user login attempts with SSO errors. This activity is significant as it may indicate brute-force attempts or the hijacking/reuse of SSO tokens. If confirmed malicious, attackers could potentially gain unauthorized access to user accounts, leading to data breaches, privilege escalation, or further lateral movement within the organization.

MITRE ATT&CK

T1556

Detection Query

`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed
  | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
    BY src vendor_account vendor_product
       dest signature user_agent
  | where count >= 5
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `o365_excessive_sso_logon_errors_filter`

Author

Rod Soto, Splunk

Created

2026-03-10

Data Sources

O365 UserLoginFailed

References

https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/

Tags

Office 365 Account TakeoverCloud Federated Credential Abuse

Raw Content

name: O365 Excessive SSO logon errors
id: 8158ccc4-6038-11eb-ae93-0242ac130002
version: 10
date: '2026-03-10'
author: Rod Soto, Splunk
status: production
type: Anomaly
description: The following analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors. It leverages data from the `o365_management_activity` dataset, focusing on failed user login attempts with SSO errors. This activity is significant as it may indicate brute-force attempts or the hijacking/reuse of SSO tokens. If confirmed malicious, attackers could potentially gain unauthorized access to user accounts, leading to data breaches, privilege escalation, or further lateral movement within the organization.
data_source:
    - O365 UserLoginFailed
search: |-
    `o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed
      | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user
        BY src vendor_account vendor_product
           dest signature user_agent
      | where count >= 5
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_excessive_sso_logon_errors_filter`
how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
known_false_positives: Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
references:
    - https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/
drilldown_searches:
    - name: View the detection results for - "$user$"
      search: '%original_detection_search% | search  user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: Excessive number of SSO logon errors from $src$ using UserAgent $user_agent$.
    risk_objects:
        - field: user
          type: user
          score: 20
    threat_objects:
        - field: src
          type: ip_address
tags:
    analytic_story:
        - Office 365 Account Takeover
        - Cloud Federated Credential Abuse
    asset_type: O365 Tenant
    mitre_attack_id:
        - T1556
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2.json
          sourcetype: o365:management:activity
          source: o365