Skip to main content

Failed sign-ins by user in the last 24 hours

Find accounts with repeated failed sign-ins, a common brute-force signal.

Beginner
Use case

Spot accounts under password-guessing pressure.

Query
KQL Microsoft SentinelDefender XDR 
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != 0
| summarize Failures = count() by UserPrincipalName
| where Failures > 5
| sort by Failures desc

Required tables: SigninLogs

Parameters to change
ParameterMeaningExample
ago(24h)Lookback periodago(7d)
Failures > 5Noise thresholdFailures > 20
Expected output

One row per user with a failure count above the threshold.

Investigation notes

Correlate with a later successful sign-in from the same user and a new IP.

False positive considerations

Service accounts and misconfigured clients can fail repeatedly and benignly.

Works with
Microsoft SentinelDefender XDR
Required tables
  • SigninLogs
ATT&CK tactic

Credential Access

Identity