Potential Malicious Sign In From Azure AD Connect Account
Query
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where UserPrincipalName startswith "Sync_" and UserPrincipalName endswith "onmicrosoft.com"
// Only alert when AppId != Microsoft Azure Active Directory Connect and the ressource is not AAD
| where AppId != "cb1056e2-e479-49de-ae31-7812af012ed8" and ResourceDisplayName != "Windows Azure Active Directory"Explanation
This query is designed to detect potential malicious sign-ins from an Azure AD Connect account. It checks for sign-in logs and non-interactive user sign-in logs where the user principal name starts with "Sync_" and ends with "onmicrosoft.com". The query filters out sign-ins with a specific AppId and a resource display name of "Windows Azure Active Directory". If any potential malicious sign-ins are found, an incident will be created and grouped by the account associated with the sign-in. The query runs every 30 minutes and has a suppression duration of 5 hours.
Details
Fabian Bader
Released: July 23, 2023
Tables
SigninLogsAADNonInteractiveUserSignInLogs
Keywords
DevicesIntuneUserAzure AD ConnectSigninLogsAADNonInteractiveUserSignInLogsAppIdResourceDisplayNameCloudApplicationIPAccount
Operators
unionisfuzzytrueSigninLogsAADNonInteractiveUserSignInLogswherestartswithendswith|!=andResourceDisplayNamesuppressionDurationcreateIncidentgroupingConfigurationmatchingMethodreopenClosedIncidentgroupByCustomDetailsgroupByEntitiesgroupByAlertDetailslookbackDurationenabledeventGroupingSettingsaggregationKindAlertPerResultentityTypeCloudApplicationfieldMappingscolumnNameidentifierIPAccountUserPrincipalNameFullNameUserIdAadUserIdsuppressionEnabled
Severity
HighTactics
LateralMovement
MITRE Techniques
Frequency: 30m
Period: 30m