Detection rules › Kusto
Anomaly Sign In Event from an IP
Identifies sign-in anomalies from an IP in the last hour, targeting multiple users where the password is correct after multiple attempts
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Entra ID | SigninLogs sign-in event: Sign-in record (SigninLogs, any result) |
Rule body
id: 9c1e9381-79dd-4ddf-9570-b73a1dc59fe0
name: Anomaly Sign In Event from an IP
description: |
'Identifies sign-in anomalies from an IP in the last hour, targeting multiple users where the password is correct after multiple attempts'
severity: Medium
requiredDataConnectors:
- connectorId: AzureActiveDirectory
dataTypes:
- SigninLogs
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1078
query: |
let LookBack = 1h;
let Data = (
SigninLogs
| where TimeGenerated >= ago(LookBack)
| where parse_json(NetworkLocationDetails)[0].networkType != "trustedNamedLocation" // Excludes known tagged networks
// Counts the number of sign in events in the last hour every 15 minutes by IP
| make-series EventCounts = count() on TimeGenerated from ago(LookBack) to now() step 15m by IPAddress
);
let AnomalyAlert = (
Data
| extend (Anomalies, Score, Baseline) = series_decompose_anomalies(EventCounts,1.5,-1,'linefit')
| mv-expand EventCounts,TimeGenerated,Anomalies to typeof(double),Baseline to typeof(long),Score to typeof(double)
| where Anomalies > 0
);
AnomalyAlert
| join kind = inner (SigninLogs
| where TimeGenerated between (ago(LookBack) .. now())
| where parse_json(NetworkLocationDetails)[0].networkType != "trustedNamedLocation"
| extend PasswordResult = tostring(parse_json(AuthenticationDetails).authenticationStepResultDetail)
| summarize UserCount = dcount(UserPrincipalName), UserList = make_set(UserPrincipalName), AppName = make_set(AppDisplayName), PasswordResult = make_list(PasswordResult) by IPAddress) on IPAddress
| where PasswordResult has "Correct Password"
| where UserCount > 1 // looks for events targeting more than one user.
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPAddress
customDetails:
Score: Score
Baseline: Baseline
UserCount: UserCount
AppName: AppName
PasswordResult: PasswordResult
UserList: UserList
version: 1.0.1
kind: Scheduled
metadata:
source:
kind: Community
author:
name: Juanse
support:
tier: Community
categories:
domains: [ "Identity" ]
Stages and Predicates
Parameters
let LookBack = 1h;
let Data and let AnomalyAlert are inlined into the numbered stages below.
Stages 1 to 7 define let AnomalyAlert (the rule's main pipeline source); stages 8 to 10 run on it.
Stage 1: source
SigninLogs
Stage 2: where
| where TimeGenerated >= ago(LookBack)
Stage 3: where
| where parse_json(NetworkLocationDetails)[0].networkType != "trustedNamedLocation"
The stages below score time-series anomalies (make-series, series_decompose_anomalies).
Stage 4: make-series
| make-series EventCounts = count() on TimeGenerated from ago(LookBack) to now() step 15m by IPAddress
Stage 5: extend
| extend (Anomalies, Score, Baseline) = series_decompose_anomalies(EventCounts,1.5,-1,'linefit')
Stage 6: mv-expand
| mv-expand EventCounts,TimeGenerated,Anomalies to typeof(double),Baseline to typeof(long),Score to typeof(double)
Stage 7: where
| where Anomalies > 0
Stage 8: join
AnomalyAlert
| join kind = inner (SigninLogs
| where TimeGenerated between (ago(LookBack) .. now())
| where parse_json(NetworkLocationDetails)[0].networkType != "trustedNamedLocation"
| extend PasswordResult = tostring(parse_json(AuthenticationDetails).authenticationStepResultDetail)
| summarize UserCount = dcount(UserPrincipalName), UserList = make_set(UserPrincipalName), AppName = make_set(AppDisplayName), PasswordResult = make_list(PasswordResult) by IPAddress) on IPAddress
Stage 9: where
| where PasswordResult has "Correct Password"
Stage 10: where
| where UserCount > 1
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Anomalies | gt |
| field:"Anomalies" kind:gt value:"0" |
PasswordResult | match |
| field:"PasswordResult" kind:match value:"Correct Password" |
UserCount | gt |
| field:"UserCount" kind:gt value:"1" |
networkType | ne |
| field:"networkType" kind:ne value:"trustedNamedLocation" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
EventCounts | summarize |
IPAddress | summarize |
Anomalies | extend |
Baseline | extend |
Score | extend |