[Rule Tuning] Tune Attempts to Brute Force a Microsoft 365 User Account

[terrancedejesus]

Issues

• [Rule Tuning] Attempts to Brute Force a Microsoft 365 User Account #3838
• https://github.com/elastic/ia-trade-team/issues/271

Summary

This pull request tunes the 'Attempts to Brute Force a Microsoft 365 User Account' rule by doing the following:

1. Converts it to use ES|QL query language
2. Adds exclusion to login error for CmsiInterrupt
3. Adds inclusion filter only for specific target user types that represent a user or registered application
4. Adds inclusion filter to include login in the request type, which excludes OAuth:Token failed logins for registered applications that typically would not be reported for external brute force attempts
5. Aggregates by target ID and login error

The big differences here are the inclusions to remove some false-positives, but also that we are aggregating on the target, not the actor. The target indicates whom is attempted to be logged into, vs whom is attempting it, which maybe external.

Ref: https://learn.microsoft.com/en-us/purview/audit-log-detailed-properties
"The user that the action (identified in the Operation property) was performed on. For example, if a guest is added to SharePoint or a Microsoft Team, that user would be listed in this property."