Measurable Increase Of Successful Authentications

Title: Measurable Increase Of Successful Authentications
Status: test
Description:Detects when successful sign-ins increased by 10% or greater.
References:
  -https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton
Date: 2022-08-11
modified:2022-08-18
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.initial-access'
• -'attack.stealth'
• -'attack.t1078'

Logsource:

• product: azure
• service: signinlogs

Detection:
  selection:
    Status: 'Success'
    Count: '<10%'
  condition:selection
Falsepositives:
  -Increase of users in the environment
Level: low