KQL Search

id: a091a0c0-2397-4dd9-a3f0-ea8a3d2dded2
name: Added temporary access pass or changed password of Azure AD connector account
description: |
  'Added TAP security information or password change event on On-Premises Sync Account. This account will be identified by IdentityInfo table (assignment to "Directory Synchronization Accounts" role) and name pattern'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - CredentialAccess
  - PrivilegeEscalation
  - InitialAccess
relevantTechniques:
  - T1098
  - T1078
query: |
  let AADConnectorAcc = (_GetWatchlist('ServiceAccounts')
      | where ['Tags'] == "Azure AD Connect" | project AccountObjectId = ['Service AAD Object Id']);
  AuditLogs
    | extend TargetUpn = tolower(tostring(TargetResources[0].userPrincipalName))
    | extend TargetId = tostring(TargetResources[0].id)
    | where TargetId in (AADConnectorAcc)
    | where (LoggedByService == "Authentication Methods" and ResultDescription == "Admin registered temporary access pass method for user") or OperationName == "Reset user password"
    | extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName),tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
    | extend InitiatingIpAddress = iff(isnotempty(InitiatedBy.user.ipAddress), tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress))
    | extend AccountCustomEntity = InitiatingUserOrApp
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled