KQL Search

This query is designed to detect unusual behavior in service principals, which are workload identities used in cloud environments. Specifically, it looks for service principals that have successfully authenticated from nine or more different IP addresses within a 24-hour period. This is considered suspicious because legitimate service principals usually authenticate from a consistent set of IP addresses, such as those associated with application servers or pipelines.

The query uses data from Azure Active Directory's service principal sign-in logs and excludes any IPs that are on an allowlist. It checks for successful login attempts (where ResultType is 0) and counts the number of unique IP addresses used by each service principal. If a service principal is found to have authenticated from more than eight different IPs, it is flagged as potentially compromised.

The alert generated by this query will include details such as the service principal's name, the number of unique IPs, and the countries associated with those IPs. The alert is given a medium severity level and is linked to tactics like Credential Access, Persistence, and Lateral Movement, as per the MITRE ATT&CK framework.

The query runs every four hours and looks back over the past 24 hours. If an anomaly is detected, an incident is created, and the alert will display a message indicating the service principal's name and the number of distinct IPs used. The incident configuration allows for grouping related alerts by the cloud application to streamline investigation.