IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Suspicious Automator Workflows Execution Suspicious Browser Child Process »
Elastic Docs ›Elastic Security Solution [8.17] ›Detections and alerts ›Prebuilt rule reference

Suspicious Azure Sign-in via Visual Studio Code

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Suspicious Azure Sign-in via Visual Studio Code

edit

Identifies login activity where the Visual Studio Code client_id is used in combination with a resourceDisplayName containing Microsoft Graph. This may indicate an attempt to authenticate via Visual Studio Code phishing.

Rule type: query

Rule indices:

  • filebeat-*
  • logs-azure.activitylogs-*
  • logs-azure.signinlogs-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-25m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Data Source: Azure
  • Use Case: Identity and Access Audit
  • Resources: Investigation Guide
  • Tactic: Initial Access

Version: 2

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Suspicious Azure Sign-in via Visual Studio Code

Possible investigation steps

  • Identify the source IP address from which the failed login attempts originated by reviewing source.ip. Determine if the IP is associated with known malicious activity using threat intelligence sources or if it belongs to a corporate VPN, proxy, or automation process.
  • Analyze affected user accounts by reviewing azure.signinlogs.properties.user_principal_name to determine if they belong to privileged roles or high-value users. Look for patterns indicating multiple failed attempts across different users, which could suggest a password spraying attempt.
  • Examine the authentication method used in azure.signinlogs.properties.authentication_details to identify which authentication protocols were attempted and why they failed. Legacy authentication methods may be more susceptible to brute-force attacks.
  • Review the authentication error codes found in azure.signinlogs.properties.status.error_code to understand why the login attempts failed. Common errors include 50126 for invalid credentials, 50053 for account lockouts, 50055 for expired passwords, and 50056 for users without a password.
  • Correlate failed logins with other sign-in activity by looking at event.outcome. Identify if there were any successful logins from the same user shortly after multiple failures or if there are different geolocations or device fingerprints associated with the same account.
  • Review azure.signinlogs.properties.app_id to identify which applications were initiating the authentication attempts. Determine if these applications are Microsoft-owned, third-party, or custom applications and if they are authorized to access the resources.
  • Check for any conditional access policies that may have been triggered by the failed login attempts by reviewing azure.signinlogs.properties.authentication_requirement. This can help identify if the failed attempts were due to policy enforcement or misconfiguration.

False positive analysis

Common benign scenarios

  • Automated scripts or applications using non-interactive authentication may trigger this detection, particularly if they rely on legacy authentication protocols recorded in azure.signinlogs.properties.authentication_protocol.
  • Corporate proxies or VPNs may cause multiple users to authenticate from the same IP, appearing as repeated failed attempts under source.ip.
  • User account lockouts from forgotten passwords or misconfigured applications may show multiple authentication failures in azure.signinlogs.properties.status.error_code.

How to reduce false positives

  • Exclude known trusted IPs, such as corporate infrastructure, from alerts by filtering source.ip.
  • Exlcude known custom applications from azure.signinlogs.properties.app_id that are authorized to use non-interactive authentication.
  • Ignore principals with a history of failed logins due to legitimate reasons, such as expired passwords or account lockouts, by filtering azure.signinlogs.properties.user_principal_name.
  • Correlate sign-in failures with password reset events or normal user behavior before triggering an alert.

Response and remediation

Immediate actions

  • Block the source IP address in source.ip if determined to be malicious.
  • Reset passwords for all affected user accounts listed in azure.signinlogs.properties.user_principal_name and enforce stronger password policies.
  • Ensure basic authentication is disabled for all applications using legacy authentication protocols listed in azure.signinlogs.properties.authentication_protocol.
  • Enable multi-factor authentication (MFA) for impacted accounts to mitigate credential-based attacks.
  • Review conditional access policies to ensure they are correctly configured to block unauthorized access attempts recorded in azure.signinlogs.properties.authentication_requirement.
  • Review Conditional Access policies to enforce risk-based authentication and block unauthorized access attempts recorded in azure.signinlogs.properties.authentication_requirement.

Long-term mitigation

  • Implement a zero-trust security model by enforcing least privilege access and continuous authentication.
  • Regularly review and update conditional access policies to ensure they are effective against evolving threats.
  • Restrict the use of legacy authentication protocols by disabling authentication methods listed in azure.signinlogs.properties.client_app_used.
  • Regularly audit authentication logs in azure.signinlogs to detect abnormal login behavior and ensure early detection of potential attacks.
  • Regularly rotate client credentials and secrets for applications using non-interactive authentication to reduce the risk of credential theft.

Rule query

edit
event.dataset:("azure.signinlogs" or "azure.activitylogs") and
event.action : "Sign-in activity" and event.outcome:(success or Success) and
(azure.activitylogs.properties.resourceDisplayName : "Microsoft Graph" or azure.signinlogs.properties.resource_display_name : "Microsoft Graph") and
(azure.signinlogs.properties.app_id : "aebc6443-996d-45c2-90f0-388ff96faa56" or azure.signinlogs.properties.app_display_name : "Visual Studio Code" or
 azure.activitylogs.properties.appDisplayName : "Visual Studio Code" or azure.activitylogs.properties.appId : "aebc6443-996d-45c2-90f0-388ff96faa56")

Framework: MITRE ATT&CKTM

« Suspicious Automator Workflows Execution Suspicious Browser Child Process »