New Authentication App Detected

Query

let KnownApps = AADSignInEventsBeta
    // Adjust the timerange depending on the retention period
    | where Timestamp  between (ago(30d) .. ago(2d))
    | distinct Application;
AADSignInEventsBeta
| where Timestamp > ago(2d)
| where not(Application in~ (KnownApps))
// If the AppID is empty then it is a third party App.
| extend IsExternalApp = iff(isempty(ApplicationId), 'True', 'False')
| project-reorder Timestamp, AccountUpn, ErrorCode, IsExternalApp, Application, AccountObjectId, IPAddress, ClientAppUsed

About this query

Explanation

This query is designed to identify new applications that are being used to send authentication requests to your organization's cloud environment. It aims to detect apps that have not been seen in the recent past, which could potentially indicate a security risk if a malicious app has been introduced.

Here's a simple breakdown of the query:

Purpose: The query checks for new applications making authentication requests to your system. These requests don't need to be successful to be detected.
Known Apps: It first creates a list of applications that have been used for authentication in the past (either 30 or 90 days ago, depending on the system being used - Defender XDR or Sentinel).
New Apps Detection: It then looks at the authentication requests from the last two days to see if there are any apps not in the known list. These are considered new or unknown apps.
Internal vs. External Apps: The query determines if the app is internal or external based on whether the AppID is present. If the AppID is missing, it is considered an external app.
Output: The query outputs a list of these new apps along with details like the timestamp, user account, error code, whether the app is external, and other relevant information.

The goal is to help identify potentially malicious apps that could be used for harmful activities, such as reconnaissance, token collection, or phishing, depending on the permissions they have.

KQL Search