KQL Search

This query is designed to detect unusual activity in Azure Active Directory (AAD) where five or more user accounts are deleted via provisioning actions within a one-hour period. Normally, user accounts are disabled first and only deleted after a retention period, so a sudden spike in deletions could indicate a problem, such as an error in data processing or a malicious attempt to remove accounts.

Here's a simple breakdown of the query:

1. Purpose: To identify when five or more user accounts are deleted through provisioning actions in AAD within an hour, which is considered abnormal.

2. Data Source: It uses logs from Azure Active Directory, specifically the AADProvisioningLogs.

3. Conditions:

   • The action must have occurred in the last hour.
   • The result of the action must be successful.
   • The action type should be either "Delete" or "StagedDelete".

4. Output:

   • Counts the number of deletions.
   • Lists the user accounts affected.
   • Identifies who initiated the deletions.
   • Records the time range during which these deletions occurred.

5. Alerting:

   • If five or more deletions are detected, an alert is triggered.
   • The alert includes details like the number of accounts deleted and the service responsible.

6. Severity and Tactics:

   • The severity of this alert is marked as high.
   • It relates to tactics like account access removal and data destruction, as per MITRE ATT&CK framework.

7. Incident Management:

   • If an alert is triggered, an incident is created.
   • Incidents are grouped by the cloud application responsible for the deletions.

This query helps in monitoring and responding to potential security threats or operational issues related to user account management in Azure Active Directory.