KQL Search

id: d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f8a
name: "SigninLogs — Password Reset Followed by New-Country Sign-In (Account Takeover)"
version: 1.0.0
kind: Scheduled
description: |
  Detects a high-confidence account takeover pattern: a password reset followed within 2 hours by a successful sign-in from a country not seen in the prior 30 days. This chain strongly indicates an attacker reset the victim password via a phishing-obtained session and immediately used the new credential. MITRE ATT&CK: T1078 (Valid Accounts), T1098 (Account Manipulation).
severity: High
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
queryFrequency: PT2H
queryPeriod: P1D
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
relevantTechniques:
  - T1078
  - T1098
query: |

    // ---- Network Allowlist (exclude trusted IPs / CIDR / ranges) --------------
    let _allow = materialize(union isfuzzy=true (print R="" | take 0), (_GetWatchlist('NetworkAllowlist') | project R = tostring(IPOrRange)) | where isnotempty(R));
    let _allowCIDR  = toscalar(_allow | where not(R matches regex @'^\d+\.\d+\.\d+\.\d+-\d+\.\d+\.\d+\.\d+$') | extend R = iff(R has '/', R, strcat(R, '/32')) | summarize make_list(R));
    let _allowRange = toscalar(_allow | where R matches regex @'^\d+\.\d+\.\d+\.\d+-\d+\.\d+\.\d+\.\d+$' | summarize make_list(R));
    let _ExcludeAllowlistedIPs = (T:(IPAddress:string)) {
        T
        | extend IPAddress = tostring(IPAddress)
        | where array_length(_allowCIDR) == 0 or isnull(ipv4_is_in_any_range(IPAddress, _allowCIDR)) or not(ipv4_is_in_any_range(IPAddress, _allowCIDR))
        | mv-apply _r = _allowRange to typeof(string) on (
            extend _lo = tostring(split(_r,'-')[0]), _hi = tostring(split(_r,'-')[1])
            | extend _inRange = ipv4_compare(IPAddress, _lo) >= 0 and ipv4_compare(IPAddress, _hi) <= 0
            | summarize _anyInRange = max(toint(_inRange)))
        | where isnull(_anyInRange) or _anyInRange == 0
        | project-away _anyInRange
    };
    // ---------------------------------------------------------------------------
    let lookback       = 2h;
    let baselinePeriod = 30d;
    let resetWindow    = 2h;
    let ResetEvents =
        AuditLogs
        | where TimeGenerated > ago(lookback + resetWindow)
        | where OperationName in (
              "Reset password (self-service)",
              "Reset user password",
              "Admin reset user password"
          )
        | extend TargetUPN = tolower(tostring(TargetResources[0].userPrincipalName))
        | where isnotempty(TargetUPN)
        | project ResetTime = TimeGenerated, TargetUPN;
    let KnownLocations =
        SigninLogs
        | invoke _ExcludeAllowlistedIPs()
        | where TimeGenerated between (ago(baselinePeriod) .. ago(lookback))
        | where ResultType == "0"
        | where isnotempty(Location) and Location != "Unknown"
        | distinct UserPrincipalName, Location;
    ResetEvents
    | join kind=inner (
        SigninLogs
        | invoke _ExcludeAllowlistedIPs()
        | where TimeGenerated > ago(lookback + resetWindow)
        | where ResultType == "0"
        | where isnotempty(Location) and Location != "Unknown"
        | extend UserPrincipalName = tolower(UserPrincipalName)
        | project
            UserPrincipalName, SignInTime = TimeGenerated,
            IPAddress, Location, AppDisplayName,
            RiskLevelDuringSignIn
      ) on $left.TargetUPN == $right.UserPrincipalName
    | where SignInTime > ResetTime
    | where SignInTime - ResetTime <= resetWindow
    | join kind=leftanti KnownLocations on UserPrincipalName, Location
    | extend MinutesSinceReset = datetime_diff("minute", SignInTime, ResetTime)
    | project
        TimeGenerated        = SignInTime,
        UserPrincipalName, IPAddress, Location,
        AppDisplayName, RiskLevelDuringSignIn,
        ResetTime, MinutesSinceReset
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserPrincipalName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
customDetails:
  Location: Location
  MinutesSinceReset: MinutesSinceReset
alertDetailsOverride:
  alertDisplayNameFormat: "Account Takeover — {{UserPrincipalName}} signed in from {{Location}} {{MinutesSinceReset}}m after reset"
  alertDescriptionFormat: "Account {{UserPrincipalName}} authenticated from a new country ({{Location}}) only {{MinutesSinceReset}} minutes after a password reset — strong indicator of account takeover."
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT4H
    matchingMethod: AllEntities
    groupByEntities:
  - Account
  - IP