HUNT 20 Signin Anomalous ASN

Query

// Hunt     : Hunt - Sign-in from Anomalous Network Location (ASN) per Identity (30d)
// Tactics  : InitialAccess
// MITRE    : T1078.004
// Purpose  : Per-user ASN baseline. Flags a successful interactive sign-in from an autonomous
//            system (network operator) the user has never authenticated from in the prior 30
//            days. Complements geo/impossible-travel by catching hosting/VPS ASNs that share a
//            country with the user's normal ISP.
//==========================================================================================

let Window = 30d;
let Recent = 1d;
let Baseline = SigninLogs
    | where TimeGenerated between (ago(Window) .. ago(Recent))
    | where ResultType == 0
    | extend ASN = tostring(AutonomousSystemNumber)
    | where isnotempty(ASN)
    | summarize KnownASNs = make_set(ASN, 200) by UserPrincipalName;
SigninLogs
| where TimeGenerated > ago(Recent)
| where ResultType == 0
| extend ASN = tostring(AutonomousSystemNumber)
| where isnotempty(ASN)
| join kind=leftouter Baseline on UserPrincipalName
| where isempty(KnownASNs) or not(set_has_element(KnownASNs, ASN))
| project TimeGenerated, UserPrincipalName, ASN, IPAddress, AppDisplayName,
    Location, ConditionalAccessStatus, RiskLevelAggregated
| order by TimeGenerated desc

Explanation

This query is designed to identify unusual sign-in activities for users based on their network locations. Here's a simplified explanation:

Objective: The query aims to detect successful sign-ins from network locations (identified by Autonomous System Numbers, or ASNs) that a user has not used in the past 30 days. This helps identify potentially suspicious activities, such as unauthorized access attempts from unfamiliar networks.
Process:
- Baseline Creation: The query first establishes a baseline of known ASNs for each user over the past 30 days. This is done by examining sign-in logs and collecting ASNs from successful sign-ins.
- Current Sign-ins Check: It then looks at sign-ins from the last day (recent 1 day) and checks if the ASN used in these sign-ins is part of the user's known ASNs.
- Flagging Anomalies: If a sign-in comes from an ASN not in the user's baseline, it is flagged as potentially anomalous.
Output: The query outputs details of these flagged sign-ins, including the time, user, ASN, IP address, application used, location, conditional access status, and risk level. The results are sorted by the time of the sign-in, with the most recent ones first.

This approach complements other security measures by focusing on network-based anomalies, which might not be caught by geographic or travel-based checks.