KQL Search

id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f
name: "SigninLogs — Service Account Interactive Browser Sign-In"
version: 1.0.0
kind: Scheduled
description: |
  Detects service accounts and non-human identities performing interactive browser-based sign-ins. Service accounts should only authenticate via client credentials or managed identity flows. Interactive sessions indicate credential theft or an attacker manually leveraging stolen service account creds. MITRE ATT&CK: T1078 (Valid Accounts), T1078.004 (Cloud Accounts).
severity: High
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
queryFrequency: PT4H
queryPeriod: PT4H
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
relevantTechniques:
  - T1078
query: |

    // ---- Network Allowlist (exclude trusted IPs / CIDR / ranges) --------------
    let _allow = materialize(union isfuzzy=true (print R="" | take 0), (_GetWatchlist('NetworkAllowlist') | project R = tostring(IPOrRange)) | where isnotempty(R));
    let _allowCIDR  = toscalar(_allow | where not(R matches regex @'^\d+\.\d+\.\d+\.\d+-\d+\.\d+\.\d+\.\d+$') | extend R = iff(R has '/', R, strcat(R, '/32')) | summarize make_list(R));
    let _allowRange = toscalar(_allow | where R matches regex @'^\d+\.\d+\.\d+\.\d+-\d+\.\d+\.\d+\.\d+$' | summarize make_list(R));
    let _ExcludeAllowlistedIPs = (T:(IPAddress:string)) {
        T
        | extend IPAddress = tostring(IPAddress)
        | where array_length(_allowCIDR) == 0 or isnull(ipv4_is_in_any_range(IPAddress, _allowCIDR)) or not(ipv4_is_in_any_range(IPAddress, _allowCIDR))
        | mv-apply _r = _allowRange to typeof(string) on (
            extend _lo = tostring(split(_r,'-')[0]), _hi = tostring(split(_r,'-')[1])
            | extend _inRange = ipv4_compare(IPAddress, _lo) >= 0 and ipv4_compare(IPAddress, _hi) <= 0
            | summarize _anyInRange = max(toint(_inRange)))
        | where isnull(_anyInRange) or _anyInRange == 0
        | project-away _anyInRange
    };
    // ---------------------------------------------------------------------------
    let serviceAccountKeywords = dynamic([
        "svc", "svc-", "svc.", "-svc", "_svc",
        "app-", "app_", "api-", "api_",
        "bot-", "bot_", "sys-", "sys_",
        "func-", "func_", "daemon", "automation",
        "robot", "service_", "service-", "noreply",
        "pipeline", "cicd", "ci-", "cd-"
    ]);
    SigninLogs
    | invoke _ExcludeAllowlistedIPs()
    | where TimeGenerated > ago(4h)
    | where ResultType == "0"
    | where IsInteractive == true
    | where ClientAppUsed == "Browser"
    | where UserPrincipalName has_any (serviceAccountKeywords)
    | project
        TimeGenerated,
        UserPrincipalName,
        IPAddress,
        Location,
        AppDisplayName,
        RiskLevel = RiskLevelDuringSignIn,
        CAStatus = ConditionalAccessStatus,
        UserAgent
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserPrincipalName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
customDetails:
  AppDisplayName: AppDisplayName
  CAStatus: CAStatus
alertDetailsOverride:
  alertDisplayNameFormat: "Service Account Interactive Login — {{UserPrincipalName}} from {{IPAddress}}"
  alertDescriptionFormat: "Service account {{UserPrincipalName}} used a browser session from {{IPAddress}} — service accounts should never authenticate interactively. Possible credential theft."
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT4H
    matchingMethod: AllEntities
    groupByEntities:
  - Account
  - IP