TH2.12 Time Window Correlation Patterns

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

// Phishing email delivered → risky sign-in within 48 hours
let maxGap = 48h;
let phishEmails = EmailEvents
| where TimeGenerated > ago(7d)
| where DeliveryAction == "Delivered"
| where ThreatTypes has "Phish"
| project PhishTime = TimeGenerated,
    User = RecipientEmailAddress,
    Subject, SenderFromAddress;
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where RiskLevelDuringSignIn in ("medium", "high")
| join kind=inner phishEmails
    on $left.UserPrincipalName == $right.User
| where TimeGenerated between (
    PhishTime .. (PhishTime + maxGap))
// Sign-in occurred AFTER the phishing email, within the gap window
// This temporal ordering is critical: reverse order (sign-in before phish)
//   is coincidence, not causation
| project PhishTime, Subject, SenderFromAddress,
    SignInTime = TimeGenerated, IPAddress,
    Country = tostring(LocationDetails.countryOrRegion),
    UserPrincipalName
| sort by PhishTime asc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

// Sign-in → MFA registration → inbox rule — all within 4 hours
// The AiTM post-compromise sequence
let sessionWindow = 4h;
let riskySignIns = SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where RiskLevelDuringSignIn in ("medium", "high")
| project SignInTime = TimeGenerated,
    UserPrincipalName, IPAddress;
let mfaRegistrations = AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has "registered security info"
| project MFATime = TimeGenerated,
    MFAUser = tostring(InitiatedBy.user.userPrincipalName);
let inboxRules = CloudAppEvents
| where TimeGenerated > ago(7d)
| where ActionType == "New-InboxRule"
| project RuleTime = TimeGenerated, RuleUser = AccountId;
// Three-way temporal join
riskySignIns
| join kind=inner mfaRegistrations
    on $left.UserPrincipalName == $right.MFAUser
| where MFATime between (SignInTime .. (SignInTime + sessionWindow))
| join kind=inner inboxRules
    on $left.UserPrincipalName == $right.RuleUser
| where RuleTime between (SignInTime .. (SignInTime + sessionWindow))
// All three events within the session window = high confidence AiTM
| project UserPrincipalName, SignInTime, IPAddress,
    MFATime, RuleTime
// This is the TH4 core detection query — temporal correlation
//   across three data sources proving a post-compromise sequence

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

// Two users signing in from the same unusual IP within 1 hour
// Shared attacker infrastructure — regardless of which user first
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where RiskLevelDuringSignIn in ("medium", "high")
| project T1 = TimeGenerated, User1 = UserPrincipalName,
    IP1 = IPAddress
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(7d)
    | where ResultType == 0
    | project T2 = TimeGenerated, User2 = UserPrincipalName,
        IP2 = IPAddress
) on $left.IP1 == $right.IP2
| where User1 != User2
| where abs(datetime_diff('minute', T1, T2)) < 60
// Two different users, same IP, within 1 hour
// Shared attacker infrastructure or shared VPN egress
// Enrich: is this IP a known corporate egress? If not, both users
//   may be compromised via the same attacker
| project T1, User1, T2, User2, SharedIP = IP1
| distinct User1, User2, SharedIP