Honey account targeted with Kerberos pre-authentication attempts

This rule detects Kerberos pre-authentication failures targeting a honey account. Such failures may indicate that an attacker is attempting to brute-force credentials or enumerate accounts using Kerberos authentication. Monitoring failed attempts against decoy (honey) accounts can help identify suspicious activity before real accounts are compromised.

For more information, see Microsoft’s documentation on Event ID 4771 – Kerberos pre-authentication failed.

A threat actor who gains access to an Exchange Online mailbox may create a new inbox rule to delete, move, or forward incoming emails – tactics commonly used in Business Email Compromise (BEC) attacks to evade detection and maintain access.

The threat is detected based on the creation of new inbox rules that meet any of the following criteria:

• Move emails to Deleted Items
• Mark emails as Read
• Forward emails to external domains

Detection is scheduled to run regularly across all Entra tenants and will trigger an alert when:

• A new inbox rule with one or more of the above suspicious actions is created
• The rule is created by someone other than the mailbox owner (e.g., via delegated access or compromised credentials)

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.