KQL Search

This query is designed to identify new audit operations in Entra ID (formerly known as Azure Active Directory) that have appeared in the last 7 days but were not present in the previous 90 days. This can help in detecting potential security events and unusual behaviors. The query specifically looks for operations related to certain MITRE ATT&CK techniques: T1078 (Valid Accounts), T1098 (Account Manipulation), and T1556 (Modify Authentication Process).

Here's a breakdown of what the query does:

1. Time Filtering: It first examines audit logs from the past 90 days up to 7 days ago to find distinct operation names.

2. Comparison: It then compares these operation names with those from the last 7 days to find any new operations that were not present in the earlier period.

3. Counting New Operations: For the operations that are new in the last 7 days, it counts how many times each operation appears.

4. Sorting: Finally, it sorts these new operations by their count in descending order, highlighting the most frequently occurring new operations.

This process helps in identifying any new or unusual activities that could indicate security issues or anomalies in the system.