Privileged User Logon from new ASN

Severity: medium
Time window: 7d
Author: Microsoft Security Research
Source: github.com/Azure/Azure-Sentinel

Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days. Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1078.004` Valid Accounts: Cloud Accounts

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`IdentityInfo` action `any`: Identity information
Entra ID	`SigninLogs` sign-in event: Successful sign-in

Rules detecting the same action

These rules filter on the same operation.

Rule body

id: 55073036-bb86-47d3-a85a-b113ac3d9396
name: Privileged User Logon from new ASN
description: |
  'Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days.
    Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
  - connectorId: BehaviorAnalytics
    dataTypes:
      - BehaviorAnalytics
  - connectorId: BehaviorAnalytics
    dataTypes:
      - IdentityInfo
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1078.004
tags:
  - AADSecOpsGuide
query: |
  let admins=(IdentityInfo
    | where AssignedRoles contains "admin" or GroupMembership has "Admin"
    | summarize by tolower(AccountUPN));
    let known_asns = (
    SigninLogs
    | where TimeGenerated between(ago(14d)..ago(1d))
    | where ResultType == 0
    | summarize by AutonomousSystemNumber);
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == 0
    | where tolower(UserPrincipalName) in (admins)
    | where AutonomousSystemNumber !in (known_asns)
    | project-reorder TimeGenerated, UserPrincipalName, UserAgent, IPAddress, AutonomousSystemNumber
    | extend AccountName = tostring(split(UserPrincipalName, "@")[0]), AccountUPNSuffix = tostring(split(UserPrincipalName, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserPrincipalName
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
version: 1.0.6
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Microsoft Security Research
    support:
        tier: Community
    categories:
        domains: [ "Identity", "Security - Others" ]

Stages and Predicates

Let binding: `admins` used in Stages 1, 5

let admins = (IdentityInfo
  | where AssignedRoles contains "admin" or GroupMembership has "Admin"
  | summarize by tolower(AccountUPN));

Let binding: `known_asns` used in Stage 6

let known_asns = (
  SigninLogs
  | where TimeGenerated between(ago(14d)..ago(1d))
  | where ResultType == 0
  | summarize by AutonomousSystemNumber);

Stage 1: `source`

let admins

Stage 2: `source`

SigninLogs

Stage 3: `where`

where TimeGenerated > ago(86400s)

Stage 4: `where`

where ResultType == 0

Stage 5: `where`

where UserPrincipalName =~ "admins"

Stage 6: `where`

where not (AutonomousSystemNumber =~ "known_asns")

Stage 7: `project-reorder`

project-reorder

Stage 8: `extend`

extend AccountName, AccountUPNSuffix

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`AutonomousSystemNumber`	eq	`known_asns`	`excludes:AutonomousSystemNumber` `field:"AutonomousSystemNumber" value:"known_asns"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ResultType`	eq	`0`	`field:"ResultType" kind:eq value:"0"`
`UserPrincipalName`	in	`admins` transforms: `tolower`	`field:"TargetUserName" kind:in value:"admins"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`

Privileged User Logon from new ASN

MITRE ATT&CK coverage

Telemetry coverage

Rules detecting the same action

Rule body

Stages and Predicates

Let binding: admins used in Stages 1, 5

Let binding: known_asns used in Stage 6

Stage 1: source

Stage 2: source

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: where

Stage 7: project-reorder

Stage 8: extend