Description
Identifies systematic off-hours activity for a single StealthTalk user - repeated authentications
outside the user's configured working hours OR on weekends, observed across at least two
distinct calendar days within a 48-hour window. The pattern is a common indicator of credential
misuse, insider threat, or compromise of the account by an attacker operating in a different
timezone.
An "off-hours event" is one where IsWeekend=true OR DeviationMinutes >= 180 (i.e. >= 3 hours
after the configured working-hours end). Three or more such events on at least two distinct
days are required for an incident to fire - a single late-evening login is not enough.
- Rule type
- Scheduled
- Version
- 1.0.0
- Declared status
- Available
- Query frequency
- 1h
- Query period
- 2d
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
let LookbackPeriod = 48h;
let MinAttempts = 3;
let MinDistinctDays = 2;
let OffHoursThreshold = 180;
StealthTalkAnomalousAuth_CL
| where TimeGenerated >= ago(LookbackPeriod)
| where EventType == "OffHoursLogin"
| where IsWeekend == true or DeviationMinutes >= OffHoursThreshold
| summarize
AttemptCount = count(),
DistinctDays = dcount(startofday(TimeGenerated)),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
DeviceIds = make_set(DeviceId),
MaxDeviation = max(DeviationMinutes),
WeekendsCount = countif(IsWeekend == true),
AppVersions = make_set(AppVersion)
by UserId
| where AttemptCount >= MinAttempts and DistinctDays >= MinDistinctDays
| extend
AlertName = "AfterHoursWork",
AlertDetails = strcat(
"User ", UserId,
" performed ", AttemptCount, " off-hours logins",
" across ", DistinctDays, " distinct days.",
" Max deviation from working hours: ", MaxDeviation, " min.",
" Weekend logins: ", WeekendsCount, "."
)
| project
TimeGenerated = LastSeen,
UserId, AttemptCount, DistinctDays, MaxDeviation,
WeekendsCount, DeviceIds, AppVersions, FirstSeen, LastSeen,
AlertName, AlertDetails
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
e3a8b2f1-5c7d-4d89-9b6e-0f1a2c3d4e5f
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC