Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-EntraID-ExtortionLockout.
Upgrade to ProDetect Entra ID Mass Password Reset and Account Disablement for Extortion Lockout in Splunk
Ransomware and extortion crews that have escalated to Global Administrator or Privileged Authentication Administrator in Entra ID (Azure AD) frequently take a final step before or during encryption: locking legitimate defenders and end users out of the tenant so incident response is slowed and the negotiation position is strengthened. Observed patterns (Scattered Spider, Lapsus$, and multiple ransomware affiliates operating from compromised cloud-admin sessions) include scripted, back-to-back calls against a large number of distinct user objects in a short window — admin-initiated password resets (`Reset password (by admin)` / `Change user password`), account disablement (`Disable account`), and outright user deletion (`Delete user`) — usually from a single initiating identity or a small number of newly-elevated identities, often followed by revocation of the legitimate admins' own refresh tokens. This differs sharply from normal offboarding/HR-driven account changes, which are typically initiated by an HR-integration service principal or IT helpdesk staff against one or a handful of accounts per day, not dozens of distinct users within minutes from a single caller. Detection relies on Entra ID audit logs (the `AuditLogs` table in Microsoft Sentinel / Log Analytics, or the equivalent audit event stream ingested into other SIEMs), correlating a burst of these operations against a high count of distinct target users from the same initiating identity.
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
index=azuread sourcetype="mscs:azure:aad"
(operationName="Reset password (by admin)" OR operationName="Change user password" OR operationName="Disable account" OR operationName="Delete user")
result="success"
| eval Initiator=coalesce('initiatedBy.user.userPrincipalName', 'initiatedBy.app.displayName')
| eval TargetUser=mvindex('targetResources{}.userPrincipalName', 0)
| where isnotnull(TargetUser)
| bin _time span=15m
| stats count as ActionCount, dc(TargetUser) as DistinctTargets, values(operationName) as Actions, values(TargetUser) as TargetSample by Initiator, _time
| where DistinctTargets >= 5
| sort - DistinctTargetsSPL detection over Entra ID audit events ingested via the Splunk Add-on for Microsoft Cloud Services (sourcetype mscs:azure:aad). Flags an initiating identity performing password reset, account disablement, or user deletion against 5 or more distinct target users within a 15-minute bucket. If a different Azure AD TA/sourcetype is in use, remap the operationName/initiatedBy/targetResources field paths to that add-on's field extraction before deploying.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Scheduled bulk offboarding run by an authorized HR/IT automation service principal
- Defensive break-glass password reset campaign following a confirmed credential-stuffing incident
- Entra ID Lifecycle Workflows disabling accounts in bulk from an HR feed
- Tenant consolidation or decommissioning projects disabling/deleting a batch of accounts
Other platforms for THREAT-EntraID-ExtortionLockout
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Bulk Password Reset Against Test Accounts
Expected signal: AuditLogs entries with OperationName='Reset password (by admin)' or 'Change user password', Result='success', InitiatedBy matching the test admin identity, and TargetResources[0].userPrincipalName matching each test account, all within a few minutes of each other.
- Test 2Simulate Bulk Account Disablement Against Test Accounts
Expected signal: AuditLogs entries with OperationName='Disable account', Result='success', for each of the five test accounts within a short window.
- Test 3Simulate Privilege Activation Immediately Followed by Lockout Actions
Expected signal: AuditLogs entries for 'Add member to role' (or 'Add eligible member to role') for the test admin identity, followed within minutes by a 'Disable account' entry initiated by that same identity.
References (6)
- https://attack.mitre.org/techniques/T1531/
- https://attack.mitre.org/tactics/TA0040/
- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs
- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1531/T1531.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-EntraID-ExtortionLockout — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month