KQL Search

This query is designed to investigate Microsoft 365 accounts with a focus on identifying potentially suspicious activities related to self-service password resets and non-managed devices. Here's a simplified breakdown:

1. Identify Users with Password Resets:

   • The query first looks at audit logs from the past 90 days to find users who have performed a self-service password reset. It collects these users' principal names into a list called UserSSPR.

2. Find Non-Managed Device Sign-ins:

   • It then examines sign-in logs from the same 90-day period to find instances where these users (UserSSPR) signed in from devices that are not managed by the organization (i.e., devices that are not iOS, Android, or trusted by Active Directory). These users are collected into a list called UserEPNonManaged.

3. Analyze Cloud App Events for VPN or Proxy Usage:

   • Finally, the query checks cloud application events from the past 90 days to see if any of the users from UserEPNonManaged have accessed services through a VPN or an anonymous proxy. It summarizes the number of such events by action type, user agent, and user ID, and sorts the results by the count of occurrences in descending order.

In essence, this query helps identify users who have reset their passwords and then accessed Microsoft 365 services from potentially untrusted devices, especially through VPNs or proxies, which could indicate suspicious activity.