detection.wiki

Detection rules › Kusto

Authentications of Privileged Accounts Outside of Expected Controls

Severity
medium
Time window
7d
Group by
AccountUPN
Author
Pete Bryan
Source
github.com/Azure/Azure-Sentinel

Detects when a privileged user account successfully authenticates from a location, device or ASN that another admin has not logged in from in the last 7 days. Privileged accounts are a key target for threat actors, monitoring for logins from these accounts that deviate from normal activity can help identify compromised accounts. Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Telemetry coverage

PlatformRecord / event type
Microsoft Defender for EndpointIdentityInfo action any: Identity information
Entra IDSigninLogs sign-in event: Successful sign-in

Rules detecting the same action

These rules filter on the same operation.

Rule body

id: af435ca1-fb70-4de1-92c1-7435c48482a9
name: Authentications of Privileged Accounts Outside of Expected Controls
description: |
  'Detects when a privileged user account successfully authenticates from a location, device or ASN that another admin has not logged in from in the last 7 days.
    Privileged accounts are a key target for threat actors, monitoring for logins from these accounts that deviate from normal activity can help identify compromised accounts.
    Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
    Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
  - connectorId: BehaviorAnalytics
    dataTypes:
      - BehaviorAnalytics
  - connectorId: BehaviorAnalytics
    dataTypes:
      - IdentityInfo
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078.004
tags:
  - AADSecOpsGuide
query: |
  let admin_users = (IdentityInfo
    | summarize arg_max(TimeGenerated, *) by AccountUPN
    | where AssignedRoles contains "admin"
    | summarize by tolower(AccountUPN));
    let admin_asn = (SigninLogs
    | where TimeGenerated between (ago(7d)..ago(1d))
    | where tolower(UserPrincipalName) in (admin_users)
    | summarize by AutonomousSystemNumber);
    let admin_locations = (SigninLogs
    | where TimeGenerated between (ago(7d)..ago(1d))
    | where tolower(UserPrincipalName) in (admin_users)
    | summarize by Location);
    let admin_devices = (SigninLogs
    | where TimeGenerated between (ago(7d)..ago(1d))
    | where tolower(UserPrincipalName) in (admin_users)
    | extend deviceId = tostring(DeviceDetail.deviceId)
    | where isnotempty(deviceId)
    | summarize by deviceId);
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == 0
    | where tolower(UserPrincipalName) in (admin_users)
    | extend deviceId = tostring(DeviceDetail.deviceId)
    | where AutonomousSystemNumber !in (admin_asn) and deviceId !in (admin_devices) and Location !in (admin_locations)
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserPrincipalName
version: 1.0.2
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Others", "Identity" ]

Stages and Predicates

Let binding: admin_users used in Stages 1, 5

let admin_users = (IdentityInfo
  | summarize arg_max(TimeGenerated, *) by AccountUPN
  | where AssignedRoles contains "admin"
  | summarize by tolower(AccountUPN));

Let binding: admin_asn used in Stage 7

let admin_asn = (SigninLogs
  | where TimeGenerated between (ago(7d)..ago(1d))
  | where tolower(UserPrincipalName) in (admin_users)
  | summarize by AutonomousSystemNumber);

Let binding: admin_locations used in Stage 7

let admin_locations = (SigninLogs
  | where TimeGenerated between (ago(7d)..ago(1d))
  | where tolower(UserPrincipalName) in (admin_users)
  | summarize by Location);

Let binding: admin_devices used in Stage 7

let admin_devices = (SigninLogs
  | where TimeGenerated between (ago(7d)..ago(1d))
  | where tolower(UserPrincipalName) in (admin_users)
  | extend deviceId = tostring(DeviceDetail.deviceId)
  | where isnotempty(deviceId)
  | summarize by deviceId);

Stage 1: source

let admin_users

Stage 2: source

SigninLogs

Stage 3: where

where TimeGenerated > ago(86400s)

Stage 4: where

where ResultType == 0

Stage 5: where

where UserPrincipalName =~ "admin_users"

Stage 6: extend

extend deviceId

Stage 7: where

where not (AutonomousSystemNumber =~ "admin_asn") and not (Location =~ "admin_locations") and not (deviceId =~ "admin_devices")

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
AutonomousSystemNumbereqadmin_asnexcludes:AutonomousSystemNumber field:"AutonomousSystemNumber" value:"admin_asn"
Locationeqadmin_locationsexcludes:Location field:"Location" value:"admin_locations"
deviceIdeqadmin_devicesexcludes:deviceId field:"deviceId" value:"admin_devices"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ResultTypeeq
  • 0
field:"ResultType" kind:eq value:"0"
UserPrincipalNamein
  • admin_users transforms: tolower
field:"TargetUserName" kind:in value:"admin_users"

Output fields

These fields are emitted when the rule matches.

FieldSource
deviceIdextend