Potential Malicious Sign In From Azure AD Connect Account UEBA
Query
let DirectorySyncAdmins = (IdentityInfo
| where TimeGenerated > ago(14d)
| where AssignedRoles contains "Directory Synchronization Accounts"
| distinct AccountUPN);
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where ingestion_time() > ago(70m)
| where UserPrincipalName in~ ( DirectorySyncAdmins )
// Only alert when AppId != Microsoft Azure Active Directory Connect and the ressource is not AAD
| where AppId != "cb1056e2-e479-49de-ae31-7812af012ed8" and ResourceDisplayName != "Windows Azure Active Directory"Explanation
This query is designed to detect potential malicious sign-ins from an Azure AD Connect account. It looks for instances where the account is accessing a resource that it should not have access to. The query frequency is set to every 1 hour, and it analyzes data from the past 14 days. The severity of this potential threat is classified as high. The query also includes tactics and relevant techniques related to lateral movement. The query is written in KQL (Kusto Query Language) and uses various filters and conditions to identify suspicious activities. If an incident is detected, it will create an incident and group it by the account involved. The query also includes entity mappings to map different types of entities such as cloud applications, IP addresses, and user accounts. Suppression is not enabled for this query.
Details
Fabian Bader
Released: August 13, 2023
Tables
Keywords
Operators
Severity
HighTactics
MITRE Techniques
Frequency: 1h
Period: 14d