Risky event Logging discrepancies

[Greg Bristow]

I had an external attacker using a rotating proxy to attempt to logon to multiple accounts. The attacker would have between 60-100 logon attempts to each account. No more than one or two events from any one location scattered across 40 or so countries.

The risky log showed a couple of successful sign-ons from an unfamiliar place for users who were scanned. While the sign-on log showed the same logon event matched on time, ip address to have failed as the account was disabled due to the high number of invalid logons locking the account.

I would be interested to know, if the successful logons logged in the risky report occurred because the attacker did successfully guess the users password and passed the first check, but was blocked on the second check of the password being available. 

Secondly i would be interested to know if there would be any different in responses, response times, etc that may provide an attacker with any form of indication that the successful response was different from the failed responses. As i worry that the attacker was smart enough to use rotating proxies, perform dictionary attackes, etc, i would have thought they would also have spaced these events out so as to not trigger account lockouts.

[#2]

As long as you see a "success" event from an IP you don't recognize, consider this account compromised.

[#3]

That it is interesting as I had a customer which logs indicates a login from overseas to an account it never existed! when we opened the ticket at Microsoft to find out how it was possible to have a successful login from overseas to an account it does not exist in the tenancy they started to scratch their head.

BTW we still have the ticket opened and they are trying to figure out what was going on .

[#4]

Now that is a worry, as somewhere there is a piece of logic that allowed that to happen. It if allowed it to happen once it could very well let it happen a lot more often. Something to think about. was there anything else specific about this that you can share so that we can see if we have had similar events.

[#5]

No much information, unfortunately. The customer told us that the mailbox never existed at all, and even that there was a clear login into their logs from overseas. No other activities, such as account creation, deletion, etc., only a successful login. Not sure if logs may have mixed between tenancies or what. Microsoft is still trying to figure out what happened.

[#6]

Thank you for your response, Yes i tend to go on the side of caution, but others may say what is there to worry about the connection did not happen. I would prefer to have my caution backed up by facts what is the logic behind getting a successful authentication event immediately followed by an unsuccessful authentication due to the account being locked. Did the attacker actually guess the users password in their dictionary attempt. If so maybe next time the will succeed.