TryHackMe Entra ID Monitoring Walkthrough 2026 | Full Guide with Splunk Queries

Detecting Identity-Based Attacks in Microsoft Entra ID Environments Using Splunk

Introduction

Identity-based attacks remain the top initial access vector in cloud environments. Microsoft telemetry shows that > 99% of account compromises are preventable with MFA, yet misconfigurations continue to allow attackers in.

This walkthrough demonstrates how to hunt and detect common Entra ID threats using Sign-in logs and Audit logs in Splunk, covering password-based attacks, MFA bypass, privilege escalation, persistence, and OAuth consent abuse.

Learning objectives:

• Detect password spraying vs throttling brute-force attempts
• Spot MFA bypass techniques
• Identify privilege escalation & persistence (role assignments, backdoors, MFA registration)
• Recognize OAuth application abuse

Prerequisites: Basic Splunk SPL knowledge, M365 monitoring basics.

Task 2: Password-Based Attacks

Goal: Differentiate between spraying (many users, few attempts each) and throttling brute-force (few users, many attempts slowly).

Query — failed sign-ins by IP:

index="task-2" sourcetype="azure:aad:signin" status.errorCode!=0 conditionalAccessStatus!="success"
| stats dc(userPrincipalName) as targeted_accounts count as failures by ipAddress
| sort - targeted_accounts

Failed sign-in attempts grouped by IP — Password spraying IP (94.20.222.248 — high targeted_accounts) and throttling brute-force IP (38.165.231.218 — high failures, low targeted_accounts)

Compromised user confirmation:

index="task-2" sourcetype="azure:aad:signin" status.errorCode=0 ipAddress="38.165.231.218"
| table _time userPrincipalName ipAddress appDisplayName status.errorCode

Successful authentications (errorCode=0) from the throttling brute-force IP-compromised account revealed: ananda.costa@finegalo.thm

Answers:

• Password spraying IP: 94.20.222.248
• Throttling brute-force IP: 38.165.231.218
• Compromised email: ananda.costa@finegalo.thm

Takeaway: Spread attempts evade lockouts; throttling hides noise. Always filter errorCode != 0 + conditionalAccess != success.

Task 3: Conditional Access & Identity Protection

Key insight: Conditional Access policies block suspicious logins (e.g., block risky countries).

Policy failures:

Conditional Access policy blocking suspicious logins — multiple failures blocked by “Block Suspicious Countries” for allan.senna@finegalo.thm

Risky user detection (Identity Protection):

Identity Protection flagging allan.senna@finegalo.thm as high-risk user (riskLevel: high, riskState: atRisk)

Takeaway: Combine Conditional Access policies + Identity Protection for early detection.

Task 4: MFA Bypass Techniques

Common bypasses: Legacy authentication or MFA fatigue/failure (error 508021).

Query — MFA failures:

index="task-4" sourcetype="azure:aad:signin" (status.errorCode=50074 OR status.errorCode=50076 OR status.errorCode=508021)
| stats count as mfa_failures values(status.errorCode) as errorCodes values(status.failureReason) as failureReasons by userPrincipalName ipAddress
| sort - mfa_failures

MFA authentication failures indicating possible bypass attempt — igor.bicalho@finegalo.thm with 10 failures (error 508021) from IP 149.102.234.27

Successful authentication post-bypass:

index="task-4" sourcetype="azure:aad:signin" userPrincipalName="igor.bicalho@finegalo.thm" status.errorCode=0
| table _time ipAddress location.countryOrRegion status.errorCode

Successful logins for igor.bicalho@finegalo.thm — first compromise from Denmark (DK) at 2026–03–02 10:58, later attempts from Brazil (BR)

Takeaway: Monitor MFA failure spikes + impossible travel.

Task 5: Privilege Escalation & Persistence

Attacker flow: Compromise → create backdoor → assign Global Admin → add MFA.

Role assignment events:

Role assignment event — igor.bicalho@finegalo.thm assigns Global Administrator to new backdoor account rafael.maciel@finegalo.thm at 2026–03–04 13:31:49

MFA device registration:

Figure 8: MFA device registration — rafael.maciel@finegalo.thm adds “Authenticator App with Code” at 2026–03–04 13:31:58 (persistence step)

Answers:

• Created user: rafael.maciel@finegalo.thm
• Role: Global Administrator
• MFA added: 2026–03–04 13:31

Takeaway: Audit logs catch post-compromise changes — hunt for unusual role assignments & MFA registrations.

Task 6: OAuth Application Abuse

Why dangerous: Consent grants survive password changes and MFA resets.

• High-risk permission: Mail.Read.All (read all mailboxes tenant-wide)
• Audit event name: Consent to application

Detection SPL:

index="main" sourcetype="azure:aad:audit" activityDisplayName="Consent to application"
| table _time initiator appName permissionsGranted

Takeaway: Revoke suspicious consents immediately; monitor admin consents for high-risk scopes.