Entra ID Sign-in TeamFiltration User-Agent Detected
Identifies potential enumeration or password spraying activity using TeamFiltration tool. TeamFiltration is an open-source enumeration, password spraying and exfiltration tool designed for Entra ID and Microsoft 365.…
Description
Identifies potential enumeration or password spraying activity using TeamFiltration tool. TeamFiltration is an open-source enumeration, password spraying and exfiltration tool designed for Entra ID and Microsoft 365. Adversaries are known to use TeamFiltration in-the-wild to enumerate users, groups, and roles, as well as to perform password spraying attacks against Microsoft Entra ID and Microsoft 365 accounts. This rule detects the use of TeamFiltration by monitoring for specific user-agent strings associated with the tool in Azure and Microsoft 365 logs.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 8 ATT&CK techniques it maps to.
- Log source category
- event_index
Known benign triggers
- Expected red team assessments or penetration tests may utilize TeamFiltration to evaluate the security posture of Azure or Microsoft 365 environments. If this is expected behavior, consider adjusting the rule or adding exceptions for specific IP addresses, registered applications, JWT tokens, PRTs or user
- Legitimate administrative or security assessment activities may use these user-agents, especially in environments where TeamFiltration is employed for authorized audits. If this is expected behavior, consider adjusting the rule or adding exceptions for specific user-agents or IP addresses.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
- T1069Permission Groups Discovery39 detections cover this technique
- T1082System Information Discovery134 detections cover this technique
- T1087Account Discovery91 detections cover this technique
- T1201Password Policy Discovery18 detections cover this technique
- T1526Cloud Service Discovery65 detections cover this technique
- T1580Cloud Infrastructure Discovery44 detections cover this technique
- T1673Virtual Machine Discovery4 detections cover this technique
References
| Reference | Cited by |
|---|---|
| github.com/Flangvik/TeamFiltration | 2 |
| www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign | 6 |
From the source
- At source
- Open at source
- Upstream identifier
- f541ca3a-5752-11f0-b44b-f661ea17fbcd
- Tagged by the source as
- Data Source: AzureData Source: Microsoft 365Data Source: Microsoft 365 Audit LogsData Source: Microsoft Entra IDData Source: Microsoft Entra ID Sign-in LogsDomain: CloudDomain: IdentityDomain: SaaSNoise: LowPerformance: FastPlatform: Entra IDPlatform: Microsoft 365Profile: RecommendedResources: Investigation GuideRule Type: Custom Query (KQL)Tactic: DiscoveryUse Case: Identity and Access AuditUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 3