HUNT 18 SP Signin New Country

Query

// Hunt     : Hunt - Service Principal Sign-in from New Country (30d baseline)
// Tactics  : InitialAccess
// MITRE    : T1078.004
// Purpose  : Per-SP geo baseline. Flags a successful workload-identity sign-in from a country
//            the SP has never authenticated from in the prior 30 days. Workload identities are
//            typically pinned to a small set of regions; a new country implies token theft or
//            credential abuse. Pairs with RULE-10 (SP CA bypass) and RULE-19 (anonymizer).
//==========================================================================================

let Window = 30d;
let Recent = 1d;
let Baseline = AADServicePrincipalSignInLogs
    | where TimeGenerated between (ago(Window) .. ago(Recent))
    | where ResultType == 0
    | summarize KnownCountries = make_set(tostring(LocationDetails.countryOrRegion), 50) by ServicePrincipalId;
AADServicePrincipalSignInLogs
| where TimeGenerated > ago(Recent)
| where ResultType == 0
| extend Country = tostring(LocationDetails.countryOrRegion)
| where isnotempty(Country)
| join kind=leftouter Baseline on ServicePrincipalId
| where isempty(KnownCountries) or not(set_has_element(KnownCountries, Country))
| project TimeGenerated, ServicePrincipalName, ServicePrincipalId, Country, IPAddress, AppId, ResultType
| order by TimeGenerated desc

Explanation

This query is designed to detect unusual sign-in activity for service principals, which are identities used by applications or services to access resources. Here's a simple breakdown of what the query does:

Purpose: The query identifies successful sign-ins from a new country for a service principal, which could indicate unauthorized access or credential abuse.
Time Frame: It examines sign-in logs over the past 30 days to establish a baseline of countries from which each service principal has successfully signed in.
Baseline Creation: It creates a list of countries (up to 50) from which each service principal has signed in during the past 30 days.
Recent Activity Check: It then looks at sign-ins from the last day to see if any service principal has signed in from a country not in its established baseline.
Output: If a service principal signs in from a new country, the query outputs details such as the time of sign-in, service principal name and ID, the new country, IP address, application ID, and result type.
Security Implication: This could indicate potential token theft or credential abuse, as service principals typically sign in from a consistent set of regions.
Relation to Other Rules: The query is related to other rules that detect bypassing of conditional access policies and the use of anonymizers.

In summary, this query helps identify potentially suspicious sign-ins by flagging service principal logins from countries they haven't accessed in the past 30 days.