Skip to content

Renamed analytic rule from BruteForceCloudPC to BruteForceAgainstEntraAuthenticatedWindowsDevice and updated name and description in Analytic Rule #14162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
v-dvedak merged 1 commit into from
Apr 30, 2026
Merged

Renamed analytic rule from BruteForceCloudPC to BruteForceAgainstEntraAuthenticatedWindowsDevice and updated name and description in Analytic Rule #14162

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ... ID/Analytic Rules/BruteForceCloudPC.yaml → ...nstanEntraAuthenticatedWindowsDevice.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
id: 3fbc20a4-04c4-464e-8fcb-6667f53e4987
name: Brute force attack against a Cloud PC
name: Brute force attack against an Entra-authenticated Windows device
description: |
'Identifies evidence of brute force activity against a Windows 365 Cloud PC by highlighting multiple authentication failures and by a successful authentication within a given time window.'
'Identifies evidence of brute force activity against Windows devices authenticated via Entra ID (including Entra-joined, hybrid-joined, and Windows 365 Cloud PCs) by detecting multiple authentication failures followed by a successful authentication within a defined time window.'
severity: Medium
requiredDataConnectors:
- connectorId: AzureActiveDirectory
Expand Down Expand Up @@ -66,5 +66,5 @@ entityMappings:
fieldMappings:
- identifier: Address
columnName: IPAddressFirst
version: 2.0.1
version: 2.0.2
kind: Scheduled
2 changes: 1 addition & 1 deletion Solutions/Microsoft Entra ID/Data/Solution_AAD.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
"Solutions/Microsoft Entra ID/Analytic Rules/AzureADRoleManagementPermissionGrant.yaml",
"Solutions/Microsoft Entra ID/Analytic Rules/AzurePortalSigninfromanotherAzureTenant.yaml",
"Solutions/Microsoft Entra ID/Analytic Rules/Brute Force Attack against GitHub Account.yaml",
"Solutions/Microsoft Entra ID/Analytic Rules/BruteForceCloudPC.yaml",
"Solutions/Microsoft Entra ID/Analytic Rules/BruteForceAgainstanEntraAuthenticatedWindowsDevice.yaml",
"Solutions/Microsoft Entra ID/Analytic Rules/BulkChangestoPrivilegedAccountPermissions.yaml",
"Solutions/Microsoft Entra ID/Analytic Rules/BypassCondAccessRule.yaml",
"Solutions/Microsoft Entra ID/Analytic Rules/CredentialAddedAfterAdminConsent.yaml",
Expand Down
Binary file added Solutions/Microsoft Entra ID/Package/3.3.12.zip
View file
Open in desktop
Binary file not shown.
4 changes: 2 additions & 2 deletions Solutions/Microsoft Entra ID/Package/createUiDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,13 +328,13 @@
{
"name": "analytic12",
"type": "Microsoft.Common.Section",
"label": "Brute force attack against a Cloud PC",
"label": "Brute force attack against an Entra-authenticated Windows device",
"elements": [
{
"name": "analytic12-text",
"type": "Microsoft.Common.TextBlock",
"options": {
"text": "Identifies evidence of brute force activity against a Windows 365 Cloud PC by highlighting multiple authentication failures and by a successful authentication within a given time window."
"text": "Identifies evidence of brute force activity against Windows devices authenticated via Entra ID (including Entra-joined, hybrid-joined, and Windows 365 Cloud PCs) by detecting multiple authentication failures followed by a successful authentication within a defined time window."
}
}
]
Expand Down
Loading
Loading