{"Actor": [{"ID": "770402eb-ca5f-43be-b009-ea7f10ff131c", "Type": 0}, {"ID": "attacker@attackrange.local", "Type": 5}], "ActorContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "ActorIpAddress": "68.188.96.150", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "AzureActiveDirectoryEventType": 1, "ClientIP": "68.188.96.150", "CreationTime": "2024-12-10T16:30:57", "DeviceProperties": [{"Name": "OS", "Value": "WindowsPhone"}, {"Name": "BrowserType", "Value": "IE"}, {"Name": "SessionId", "Value": "d2b6b09b-bd47-4463-a91e-a05f0d7b4f25"}], "ErrorNumber": "53003", "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; NOKIA; Lumia 635) like iPhone OS 7_0_3 Mac OS X AppleWebKit/537 (KHTML, like Gecko) Mobile Safari/537"}, {"Name": "UserAuthenticationMethod", "Value": "8"}, {"Name": "RequestType", "Value": "Login:login"}], "Id": "5de2c8fc-850b-407a-a620-0061c2236300", "InterSystemsId": "dcc6065d-bbd6-0b09-2a0e-3f426d172cb7", "IntraSystemId": "5de2c8fc-850b-407a-a620-0061c2236300", "LogonError": "BlockedByConditionalAccess", "ModifiedProperties": [], "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "RecordType": 15, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserId": "attacker@attackrange.local", "UserKey": "770402eb-ca5f-43be-b009-ea7f10ff131c", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}
{"Actor": [{"ID": "770402eb-ca5f-43be-b009-ea7f10ff131c", "Type": 0}, {"ID": "attacker@attackrange.local", "Type": 5}], "ActorContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "ActorIpAddress": "68.188.96.150", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "AzureActiveDirectoryEventType": 1, "ClientIP": "68.188.96.150", "CreationTime": "2024-12-10T16:30:56", "DeviceProperties": [{"Name": "OS", "Value": "Ios"}, {"Name": "BrowserType", "Value": "Safari"}], "ErrorNumber": "399218", "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1"}, {"Name": "UserAuthenticationMethod", "Value": "8"}, {"Name": "RequestType", "Value": "Login:login"}], "Id": "f7277a74-6ce2-4736-be4e-220843f75d00", "InterSystemsId": "786a8b89-d8c1-9f01-769f-7d144db91e27", "IntraSystemId": "f7277a74-6ce2-4736-be4e-220843f75d00", "ModifiedProperties": [], "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "RecordType": 15, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserId": "attacker@attackrange.local", "UserKey": "770402eb-ca5f-43be-b009-ea7f10ff131c", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}
{"Actor": [{"ID": "770402eb-ca5f-43be-b009-ea7f10ff131c", "Type": 0}, {"ID": "attacker@attackrange.local", "Type": 5}], "ActorContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "ActorIpAddress": "68.188.96.150", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "AzureActiveDirectoryEventType": 1, "ClientIP": "68.188.96.150", "CreationTime": "2024-12-10T16:30:55", "DeviceProperties": [{"Name": "OS", "Value": "Android"}, {"Name": "BrowserType", "Value": "Chrome"}], "ErrorNumber": "399218", "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Mobile Safari/537.36"}, {"Name": "UserAuthenticationMethod", "Value": "8"}, {"Name": "RequestType", "Value": "Login:login"}], "Id": "4d353ce0-3ec8-41c1-86c0-4b5690471400", "InterSystemsId": "697fdb95-1469-3187-4c1b-3890505a8584", "IntraSystemId": "4d353ce0-3ec8-41c1-86c0-4b5690471400", "ModifiedProperties": [], "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "RecordType": 15, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserId": "attacker@attackrange.local", "UserKey": "770402eb-ca5f-43be-b009-ea7f10ff131c", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}
{"Actor": [{"ID": "770402eb-ca5f-43be-b009-ea7f10ff131c", "Type": 0}, {"ID": "attacker@attackrange.local", "Type": 5}], "ActorContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "ActorIpAddress": "68.188.96.150", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "AzureActiveDirectoryEventType": 1, "ClientIP": "68.188.96.150", "CreationTime": "2024-12-10T16:30:54", "DeviceProperties": [{"Name": "OS", "Value": "MacOs"}, {"Name": "BrowserType", "Value": "Safari"}], "ErrorNumber": "399218", "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15"}, {"Name": "UserAuthenticationMethod", "Value": "8"}, {"Name": "RequestType", "Value": "Login:login"}], "Id": "6a7e017c-6f4a-4ef6-90f9-747325281100", "InterSystemsId": "db1a8374-e899-83b5-38e6-a6d021aca110", "IntraSystemId": "6a7e017c-6f4a-4ef6-90f9-747325281100", "ModifiedProperties": [], "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "RecordType": 15, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserId": "attacker@attackrange.local", "UserKey": "770402eb-ca5f-43be-b009-ea7f10ff131c", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}
{"Actor": [{"ID": "770402eb-ca5f-43be-b009-ea7f10ff131c", "Type": 0}, {"ID": "attacker@attackrange.local", "Type": 5}], "ActorContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "ActorIpAddress": "68.188.96.150", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "AzureActiveDirectoryEventType": 1, "ClientIP": "68.188.96.150", "CreationTime": "2024-12-10T16:30:53", "DeviceProperties": [{"Name": "OS", "Value": "Linux"}, {"Name": "BrowserType", "Value": "Firefox"}], "ErrorNumber": "399218", "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0"}, {"Name": "UserAuthenticationMethod", "Value": "8"}, {"Name": "RequestType", "Value": "Login:login"}], "Id": "f7277a74-6ce2-4736-be4e-2208cef65d00", "InterSystemsId": "8ef7f375-405f-9578-1d04-70b6d2bca028", "IntraSystemId": "f7277a74-6ce2-4736-be4e-2208cef65d00", "ModifiedProperties": [], "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "RecordType": 15, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserId": "attacker@attackrange.local", "UserKey": "770402eb-ca5f-43be-b009-ea7f10ff131c", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}
{"Actor": [{"ID": "770402eb-ca5f-43be-b009-ea7f10ff131c", "Type": 0}, {"ID": "attacker@attackrange.local", "Type": 5}], "ActorContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "ActorIpAddress": "68.188.96.150", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "AzureActiveDirectoryEventType": 1, "ClientIP": "68.188.96.150", "CreationTime": "2024-12-10T16:30:52", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Edge"}], "ErrorNumber": "399218", "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56"}, {"Name": "UserAuthenticationMethod", "Value": "8"}, {"Name": "RequestType", "Value": "Login:login"}], "Id": "4d353ce0-3ec8-41c1-86c0-4b5620471400", "InterSystemsId": "f25fcfb2-0039-60f4-a10d-d8003f5fd0e3", "IntraSystemId": "4d353ce0-3ec8-41c1-86c0-4b5620471400", "ModifiedProperties": [], "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "RecordType": 15, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserId": "attacker@attackrange.local", "UserKey": "770402eb-ca5f-43be-b009-ea7f10ff131c", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}
{"Actor": [{"ID": "770402eb-ca5f-43be-b009-ea7f10ff131c", "Type": 0}, {"ID": "attacker@attackrange.local", "Type": 5}], "ActorContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "ActorIpAddress": "68.188.96.150", "ApplicationId": "1950a258-227b-4e31-a9cf-717495945fc2", "AzureActiveDirectoryEventType": 1, "ClientIP": "68.188.96.150", "CreationTime": "2024-12-10T16:30:51", "DeviceProperties": [{"Name": "OS", "Value": "Windows"}, {"Name": "BrowserType", "Value": "Other"}, {"Name": "SessionId", "Value": "23a4cadf-e861-42d5-a4e6-9810a3a5d11e"}], "ErrorNumber": "53003", "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "UserError"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.4391"}, {"Name": "UserAuthenticationMethod", "Value": "8"}, {"Name": "RequestType", "Value": "OAuth2:Token"}], "Id": "7657facc-588b-4009-b8ae-970a2ccd1200", "InterSystemsId": "7fead4e8-f72a-48c7-acdf-370dabc7be52", "IntraSystemId": "7657facc-588b-4009-b8ae-970a2ccd1200", "LogonError": "BlockedByConditionalAccess", "ModifiedProperties": [], "ObjectId": "797f4846-ba00-4fd7-ba43-dac1f8f63013", "Operation": "UserLoginFailed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "RecordType": 15, "ResultStatus": "Failed", "SupportTicketId": "", "Target": [{"ID": "797f4846-ba00-4fd7-ba43-dac1f8f63013", "Type": 0}], "TargetContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserId": "attacker@attackrange.local", "UserKey": "770402eb-ca5f-43be-b009-ea7f10ff131c", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}
{"Actor": [{"ID": "770402eb-ca5f-43be-b009-ea7f10ff131c", "Type": 0}, {"ID": "attacker@attackrange.local", "Type": 5}], "ActorContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "ActorIpAddress": "68.188.96.150", "ApplicationId": "1b730954-1685-4b74-9bfd-dac224a7b894", "AzureActiveDirectoryEventType": 1, "ClientIP": "68.188.96.150", "CreationTime": "2024-12-10T16:30:50", "DeviceProperties": [{"Name": "OS", "Value": "Windows"}, {"Name": "BrowserType", "Value": "Other"}, {"Name": "SessionId", "Value": "6e022de8-7c59-4cc9-aa46-154aacdb5576"}], "ErrorNumber": "53003", "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "UserError"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.4391"}, {"Name": "UserAuthenticationMethod", "Value": "8"}, {"Name": "RequestType", "Value": "OAuth2:Token"}], "Id": "0fcd24d1-2d80-4c3e-8035-629af1a35000", "InterSystemsId": "02eeaaa5-50db-496e-a050-8b06178a8cdb", "IntraSystemId": "0fcd24d1-2d80-4c3e-8035-629af1a35000", "LogonError": "BlockedByConditionalAccess", "ModifiedProperties": [], "ObjectId": "00000002-0000-0000-c000-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "RecordType": 15, "ResultStatus": "Failed", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0000-c000-000000000000", "Type": 0}], "TargetContextId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserId": "attacker@attackrange.local", "UserKey": "770402eb-ca5f-43be-b009-ea7f10ff131c", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}