13.13 Detection Engineering

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

let known_user_ips =
    SigninLogs
    | where TimeGenerated > ago(30d)
    | where ResultType == 0
    | distinct UserPrincipalName, IPAddress;
AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(1h)
| where ResultType == 0
| join kind=anti known_user_ips on UserPrincipalName, IPAddress
| extend Country = tostring(LocationDetails.countryOrRegion)
| summarize EventCount = count(), Apps = make_set(AppDisplayName),
    Countries = make_set(Country)
    by UserPrincipalName, IPAddress
| where EventCount > 3

1
2
3
4
5
6

CloudAppEvents
| where TimeGenerated > ago(1m)
| where ActionType in ("New-InboxRule", "Set-InboxRule")
| extend Params = tostring(RawEventData.Parameters)
| where Params has_any ("security", "password", "unusual", "alert",
    "phishing", "hack", "compromised", "reset", "verify", "suspicious")

1
2
3
4

EmailUrlInfo
| where TimeGenerated > ago(1m)
| where Url matches regex @"/auth/[a-f0-9]{32}/login"
| join kind=inner (EmailEvents | where TimeGenerated > ago(1m)) on NetworkMessageId

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

let recent_signins =
    SigninLogs
    | where TimeGenerated > ago(1h)
    | where ResultType == 0
    | project SigninTime = TimeGenerated, User = UserPrincipalName, SigninIP = IPAddress;
CloudAppEvents
| where TimeGenerated > ago(1h)
| where ActionType == "New-InboxRule"
| project RuleTime = TimeGenerated, User = AccountDisplayName, RuleIP = IPAddress
| join kind=inner recent_signins on User
| where RuleTime > SigninTime
| extend MinutesGap = datetime_diff('minute', RuleTime, SigninTime)
| where MinutesGap < 30

1
2
3
4
5
6
7

UrlClickEvents
| where TimeGenerated > ago(15m)
| where IsClickedThrough == true
| summarize ClickCount = count(), Users = dcount(AccountUpn),
    Urls = make_set(Url)
    by UrlDomain
| where ClickCount > 3

1
2
3
4
5
6
7
8
9

AuditLogs
| where TimeGenerated > ago(1h)
| where OperationName has "User registered security info"
| extend User = tostring(TargetResources[0].userPrincipalName)
| extend IP = tostring(InitiatedBy.user.ipAddress)
| join kind=anti (
    SigninLogs | where TimeGenerated > ago(30d) | where ResultType == 0
    | distinct UserPrincipalName, IPAddress
) on $left.User == $right.UserPrincipalName, $left.IP == $right.IPAddress