<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Authentication Anomalies — API Reference

## Splunk Queries

### Password Spraying Detection

```spl
index=wineventlog EventCode=4625
| stats dc(TargetUserName) as unique_users count by src_ip
| where unique_users > 10 AND count > 20
| sort -unique_users
```

### Service Account Interactive Logon

```spl
index=wineventlog EventCode=4624 LogonType=2
| search TargetUserName="svc_*" OR TargetUserName="sa_*"
| table _time, TargetUserName, src_ip, WorkstationName
```

## KQL (Microsoft Sentinel)

### Azure AD Password Spray

```kql
SigninLogs
| where ResultType == "50126"
| summarize Failures=count(), Users=dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 1h)
| where Users > 10
```

### Impossible Travel

```kql
SigninLogs
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, IPAddress, Location
| sort by UserPrincipalName, TimeGenerated asc
| extend PrevTime=prev(TimeGenerated), PrevLocation=prev(Location), PrevUser=prev(UserPrincipalName)
| where UserPrincipalName == PrevUser and Location != PrevLocation
| extend TimeDiffMin=datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiffMin < 120
```

### MFA Fatigue

```kql
AADNonInteractiveUserSignInLogs
| where ResultType in ("50074", "500121")
| summarize Denials=count() by UserPrincipalName, bin(TimeGenerated, 30m)
| where Denials >= 5
```

## Microsoft Graph API

### Sign-in Logs

```bash
curl -s "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=createdDateTime ge 2026-03-15" \
  -H "Authorization: Bearer $GRAPH_TOKEN"
```

## Okta System Log API

```bash
curl -s "https://company.okta.com/api/v1/logs?filter=eventType eq \"user.session.start\"&since=2026-03-15T00:00:00Z" \
  -H "Authorization: SSWS $OKTA_TOKEN"
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `EventCode 4625` | Failed logon | Password spray indicator |
| `ResultType 50126` | Azure AD invalid password | Spray/stuffing indicator |
| `LogonType 2` | Interactive logon | Anomalous for service accounts |
| `T1110.003` | Password Spraying | ATT&CK technique |
| `T1621` | MFA Request Generation | MFA fatigue attack |
