KQL Search

This query is designed to detect unusual activity by a new Service Principal (SP) in Azure Active Directory. It identifies SPs that have started performing provisioning operations for the first time in the last 30 days and have generated at least 50 events in the past 24 hours. This could indicate a potential security threat, such as an attacker using a newly registered application to manipulate accounts or write unauthorized data.

Here's a simplified breakdown of the query:

1. Purpose: To detect new Service Principals that are performing provisioning operations for the first time in the last 30 days and have a high volume of activity (50 or more events) in the last 24 hours.

2. Data Source: It uses logs from Azure Active Directory, specifically the AADProvisioningLogs.

3. Logic:

   • Recent Activity: It checks for Service Principals that have been active in the last 24 hours and counts their events.
   • Historical Check: It ensures these Service Principals have not been seen performing provisioning operations in the previous 30 days.
   • Alert Generation: If a Service Principal meets these criteria, an alert is generated.

4. Severity and Tactics: The alert is marked with medium severity and is associated with persistence and privilege escalation tactics, referencing specific MITRE ATT&CK techniques.

5. Alert Details: The alert includes details such as the name of the Service Principal, the number of operations, and the types of operations performed. It suggests verifying the SP against an approved application inventory.

6. Incident Management: The query is set to create an incident if such activity is detected, with specific configurations for grouping and managing incidents.

Overall, this query helps security teams monitor for potentially unauthorized or suspicious provisioning activities by new Service Principals, which could indicate a supply chain attack or persistence mechanism by an attacker.