KQL Search

id: c9d0e1f2-a3b4-4c5d-6e7f-8a9b0c1d2e3f
name: "SigninLogs — High-Frequency Repeated Sign-Ins (Automated Credential Abuse)"
version: 1.0.0
kind: Scheduled
description: |
  Detects accounts producing 10+ successful sign-in events per hour from the same IP. At that frequency, activity is almost certainly generated by an automated tool, a script, or a C2 framework maintaining stolen token freshness. MITRE ATT&CK: T1078 (Valid Accounts), T1539 (Steal Web Session Cookie).
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
queryFrequency: PT1H
queryPeriod: PT1H
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
  - Persistence
relevantTechniques:
  - T1078
  - T1539
  - T1528
query: |

    // ---- Network Allowlist (exclude trusted IPs / CIDR / ranges) --------------
    let _allow = materialize(union isfuzzy=true (print R="" | take 0), (_GetWatchlist('NetworkAllowlist') | project R = tostring(IPOrRange)) | where isnotempty(R));
    let _allowCIDR  = toscalar(_allow | where not(R matches regex @'^\d+\.\d+\.\d+\.\d+-\d+\.\d+\.\d+\.\d+$') | extend R = iff(R has '/', R, strcat(R, '/32')) | summarize make_list(R));
    let _allowRange = toscalar(_allow | where R matches regex @'^\d+\.\d+\.\d+\.\d+-\d+\.\d+\.\d+\.\d+$' | summarize make_list(R));
    let _ExcludeAllowlistedIPs = (T:(IPAddress:string)) {
        T
        | extend IPAddress = tostring(IPAddress)
        | where array_length(_allowCIDR) == 0 or isnull(ipv4_is_in_any_range(IPAddress, _allowCIDR)) or not(ipv4_is_in_any_range(IPAddress, _allowCIDR))
        | mv-apply _r = _allowRange to typeof(string) on (
            extend _lo = tostring(split(_r,'-')[0]), _hi = tostring(split(_r,'-')[1])
            | extend _inRange = ipv4_compare(IPAddress, _lo) >= 0 and ipv4_compare(IPAddress, _hi) <= 0
            | summarize _anyInRange = max(toint(_inRange)))
        | where isnull(_anyInRange) or _anyInRange == 0
        | project-away _anyInRange
    };
    // ---------------------------------------------------------------------------
    let loginMinimum = 10;
    SigninLogs
    | invoke _ExcludeAllowlistedIPs()
    | where TimeGenerated > ago(1h)
    | where ResultType == "0"
    | where isnotempty(IPAddress) and isnotempty(UserPrincipalName)
    | summarize
        LoginCount  = count(),
        UniqueApps  = dcount(AppDisplayName),
        Apps        = make_set(AppDisplayName, 10),
        Locations   = make_set(Location, 3),
        FirstLogin  = min(TimeGenerated),
        LastLogin   = max(TimeGenerated)
      by UserPrincipalName, IPAddress
    | where LoginCount >= loginMinimum
    | extend
        WindowMinutes   = datetime_diff("minute", LastLogin, FirstLogin),
        LoginFreqPerMin = round(
            todouble(LoginCount) /
            (todouble(datetime_diff("second", LastLogin, FirstLogin)) / 60.0 + 1.0), 2)
    | project
        TimeGenerated = FirstLogin,
        UserPrincipalName, IPAddress,
        LoginCount, UniqueApps,
        LoginFreqPerMin, WindowMinutes,
        Apps, Locations, LastLogin
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserPrincipalName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
customDetails:
  LoginCount: LoginCount
  LoginFreqPerMin: LoginFreqPerMin
alertDetailsOverride:
  alertDisplayNameFormat: "Automated Sign-Ins — {{UserPrincipalName}} from {{IPAddress}} — {{LoginCount}} logins/hr"
  alertDescriptionFormat: "Account {{UserPrincipalName}} produced {{LoginCount}} successful sign-ins/hour from {{IPAddress}} — automated tooling or C2 token refresh pattern."
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT1H
    matchingMethod: AllEntities
    groupByEntities:
  - Account
  - IP