Credentials Validation Burst (Microsoft Defender for Identity)
Detects a high volume of authentication or credential validation attempts against Active Directory accounts within a short timeframe. This behavior is commonly associated with automated credential‑testing activity such as password spraying or brute‑force attempts and should be investigated.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = "microsoft"
| #event.module = "defender-identity"
| Vendor.category = "AdvancedHunting-IdentityLogonEvents"
| Vendor.properties.LogonType = "Credentials validation"
| groupBy([user.name, source.address], function=[count(as=validation_count),count(field=Vendor.properties.DestinationDeviceName, distinct=true, as=unique_destinations),collect(fields=Vendor.properties.DestinationDeviceName),min(@timestamp, as=start_time),max(@timestamp, as=end_time)])
| validation_count > 50 //Adjust the value as per your enviorment
| time_diff_min := (end_time - start_time) / 60000
| time_diff_min <= 10 //Adjust the value as per your enviorment
| start_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=start_time, timezone="UTC")
| end_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=end_time, timezone="UTC")
| drop([start_time, end_time])
| sort([validation_count], order=desc)Detects a high volume of authentication or credential validation attempts against Active Directory accounts within a short timeframe. This behavior is commonly associated with automated credential‑testing activity such as password spraying or brute‑force attempts and should be investigated.
credentials_validation_burst_microsoft_defender_for_identity.yml
T1110
Kundan Kumar
Detection
Identity
Identity
2026-05-08
2026-05-21
