KQL Search

//Detects when a user registers MFA details on their account and then completes self service password reset with a short timeframe

//Data connector required for this query - Azure Active Directory - Signin Logs
//Data connector required for this query - Azure Active Directory - Audit Logs

let timeframe=4h;
AuditLogs
| where TimeGenerated > ago(1d)
| where OperationName in~ ("User changed default security info", "User registered all required security info", "User registered security info","Admin registered security info")
| extend User = tostring(TargetResources[0].userPrincipalName)
| project SecurityInfoTime=TimeGenerated, User, OperationName
| join kind=inner (
    AuditLogs
    | where TimeGenerated > ago(1d)
    | where OperationName in ("Reset password (self-service)", "Change password (self-service)")
    | where Result == "success"
    | extend User = tostring(TargetResources[0].userPrincipalName)
    | project PasswordResetTime=TimeGenerated, OperationName, User)
    on User
| where (PasswordResetTime - SecurityInfoTime) between (0min .. timeframe)