Detection rules › Kusto
Suspicious Sign In by Entra ID Connect Sync Account
'This query looks for sign ins by the Microsoft Entra ID Connect Sync account to Azure where properties about the logon are anomalous. This query uses Microsoft Sentinel's UEBA features to detect these suspicious properties. A threat actor may attempt to steal the Sync account credentials and use them to access Azure resources. This alert should be reviewed to ensure that the log in came was from a legitimate source.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078.004 Valid Accounts: Cloud Accounts |
Rule body kusto
id: 2cd8b3d5-c9e0-4be3-80f7-0469d511c3f6
name: Suspicious Sign In by Entra ID Connect Sync Account
description: |
'This query looks for sign ins by the Microsoft Entra ID Connect Sync account to Azure where properties about the logon are anomalous.
This query uses Microsoft Sentinel's UEBA features to detect these suspicious properties.
A threat actor may attempt to steal the Sync account credentials and use them to access Azure resources. This alert should be
reviewed to ensure that the log in came was from a legitimate source.'
severity: Medium
requiredDataConnectors:
- connectorId: BehaviorAnalytics
dataTypes:
- BehaviorAnalytics
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
- InitialAccess
relevantTechniques:
- T1078.004
query: |
BehaviorAnalytics
// User modification is expected from this account so focus on logons
| where ActivityType =~ "LogOn"
| where UserName startswith "Sync_" and UsersInsights.AccountDisplayName =~ "On-Premises Directory Synchronization Service Account"
// Filter out this expected activity
| where ActivityInsights.App !~ "Microsoft Azure Active Directory Connect"
| where InvestigationPriority > 0
| extend Name = split(UserPrincipalName, "@")[0], UPNSuffix = split(UserPrincipalName, "@")[1]
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: UserPrincipalName
- identifier: Name
columnName: Name
- identifier: UPNSuffix
columnName: UPNSuffix
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIPAddress
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: DestinationDevice
alertDetailsOverride:
alertDisplayNameFormat: Suspicious Sign In by AAD Connect Sync Account {{UserPrincipalName}} from {{SourceIPAddress}}
alertDescriptionFormat: |
This query looks for sign ins by the Azure AD Connect Sync account to Azure where properties about the logon are anomalous.
This query uses Microsoft Sentinel's UEBA features to detect these suspicious properties.
A threat actor may attempt to steal the Sync account credentials and use them to access Azure resources. This alert should be
reviewed to ensure that the log in came was from a legitimate source.
In this case {{UserPrincipalName}} logged in from {{SourceIPAddress}}.
version: 1.0.3
kind: Scheduled
metadata:
source:
kind: Community
author:
name: Microsoft Security Community
support:
tier: Community
categories:
domains: [ "Identity", "Security - Threat Protection" ]
Stages and Predicates
Stage 1: source
BehaviorAnalytics
Stage 2: where
| where ActivityType =~ "LogOn"
Stage 3: where
| where UserName startswith "Sync_" and UsersInsights.AccountDisplayName =~ "On-Premises Directory Synchronization Service Account"
Stage 4: where
| where ActivityInsights.App !~ "Microsoft Azure Active Directory Connect"
Stage 5: where
| where InvestigationPriority > 0
Stage 6: extend
| extend Name = split(UserPrincipalName, "@")[0], UPNSuffix = split(UserPrincipalName, "@")[1]
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
AccountDisplayName | eq |
|
ActivityType | eq |
|
App | ne |
|
InvestigationPriority | gt |
|
UserName | starts_with |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
Name | extend |
UPNSuffix | extend |