Lab Objective
Deploy Microsoft Sentinel as a cloud-native SIEM in Azure, configure a Windows virtual machine to forward Security Events via the Azure Monitor Agent, write a custom KQL detection rule for failed login attempts (Event ID 4625), simulate a brute force attack, and investigate the resulting incident in Microsoft Defender XDR.
This lab demonstrates the complete cloud SOC pipeline — from log ingestion and detection engineering to incident triage — using the same toolstack found in enterprise security operations centers.
Microsoft Sentinel successfully detected 30 failed login attempts from IP 64.183.42.233 targeting RTR-WinVM. 7 incidents were generated in the Defender XDR incident queue. Full detection chain validated end-to-end.
Lab Environment
The data pipeline flows from the Windows VM through the Azure Monitor Agent (AMA), governed by a Data Collection Rule (DCR), into the Log Analytics Workspace, and then into Microsoft Sentinel for detection and alerting.
KQL Detection Rule
A scheduled query analytic rule was created in Microsoft Sentinel to detect Windows brute force login attempts by monitoring Event ID 4625 (Failed Logon). The rule runs every 5 minutes and looks back over the last hour, alerting when 5 or more failed attempts are detected from a single account/IP combination.
Log Analytics Verification
Before creating the detection rule, log ingestion was verified by querying the SecurityEvent table directly in Log Analytics. The query returned 10 events from RTR-WinVM timestamped within the current session, confirming the data pipeline was functioning correctly.
Results confirmed events from WORKGROUP\RTR-WinVM$ and NT AUTHORITY\SYSTEM with timestamps matching the current session — proving end-to-end connectivity from the VM through AMA, DCR, and into the Log Analytics workspace.
Brute Force Simulation
A brute force login simulation was performed against RTR-WinVM via RDP to generate real Event ID 4625 telemetry. The simulation used intentionally invalid credentials to produce failed logon events without compromising any actual accounts.
| PARAMETER | VALUE |
|---|---|
| Target Machine | RTR-WinVM |
| Target IP | 20.127.82.236 |
| Protocol | RDP (Port 3389) |
| Simulated Username | .\fakeuser |
| Simulated Password | [intentionally incorrect] |
| Attempts Made | 10 manual RDP attempts |
| Total Attempts Detected | 30 (within 1-hour lookback window) |
| Event ID Generated | 4625 — An account failed to log on |
Incident Analysis
The Sentinel analytic rule triggered successfully. Multiple incidents were generated in the Microsoft Defender XDR incident queue within minutes of the simulation.
Alert Query Results — IOCs Identified
| FIELD | VALUE | NOTES |
|---|---|---|
| Account | .\fakeuser | Local non-existent account — enumeration attempt |
| Computer | RTR-WinVM | Target machine |
| Source IP | 64.183.42.233 | External IP — attacker origin |
| Failed Attempts | 30 | Well above threshold of 5 — confirmed brute force pattern |
| Event ID | 4625 | Windows Security: An account failed to log on |
Incident Timeline
Findings & MITRE Mapping
The 30 failed login attempts from a single external IP targeting a non-existent local account (fakeuser) on RTR-WinVM is consistent with an automated credential brute force attack pattern. Key indicators:
- High attempt volume in a compressed timeframe — 30 failures in under 1 hour indicates automation
- Single source IP targeting one machine — targeted brute force, not distributed credential spray
- Account name 'fakeuser' does not exist on the system — attacker attempting account enumeration
- No successful logon (Event ID 4624) following the failures — access was not achieved
- RDP exposed on public IP — attack vector is open internet-facing Remote Desktop
| MITRE FIELD | VALUE |
|---|---|
| Tactic | Credential Access (TA0006) |
| Technique | Brute Force (T1110) |
| Sub-technique | Password Guessing (T1110.001) |
| Objective | Gain unauthorized RDP access to RTR-WinVM |
Containment & Recommendations
The following containment actions would be taken in a production environment:
- Block source IP 64.183.42.233 at the Azure Network Security Group (NSG) level immediately
- Disable public RDP (port 3389) exposure — restrict access to Azure Bastion or VPN only
- Enable account lockout policy after 5 failed attempts via Group Policy
- Enable MFA for all accounts with RDP access
- Sweep other machines in the environment for login attempts from the same source IP
- Review Azure Activity Log for any unauthorized resource modifications from the source IP
- Escalate to Tier 2 if lateral movement or additional IOCs are identified
Key Takeaways
- Microsoft Sentinel ingested Windows Security Events from RTR-WinVM via AMA and the rtr-dcr-windowsevents DCR with no data loss
- KQL query using EventID 4625 with summarize and threshold filtering effectively surfaced brute force activity while reducing noise
- The 5-minute scheduled rule with 1-hour lookback provided near real-time detection — incidents appeared in Defender XDR within minutes
- Microsoft Defender XDR consolidates Sentinel incidents with broader XDR telemetry — this integration mirrors enterprise SOC architecture
- Public RDP exposure is a high-risk attack surface — this lab demonstrates exactly why it should never be left open on production systems
- Sentinel's analytics rule wizard makes detection engineering accessible while the underlying KQL provides enterprise-grade flexibility