{ "version": "Notebook/1.0", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "20000000-0000-4000-8000-000000000001", "version": "KqlParameterItem/1.0", "name": "DefaultSubscription_Internal", "type": 1, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\n| take 1\n| project subscriptionId", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "isHiddenWhenLocked": true, "key": "20000000-0000-4000-8000-000000000001" }, { "id": "20000000-0000-4000-8000-000000000002", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "query": "summarize by subscriptionId\n| project value = strcat('/subscriptions/', subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "key": "20000000-0000-4000-8000-000000000002" }, { "id": "20000000-0000-4000-8000-000000000003", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "query": "where type =~ 'microsoft.operationalinsights/workspaces'\n| project id", "crossComponentResources": [ "{Subscription}" ], "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true }, "additionalResourceOptions": [] }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": "", "key": "20000000-0000-4000-8000-000000000003" }, { "id": "20000000-0000-4000-8000-000000000004", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "key": "20000000-0000-4000-8000-000000000004" }, { "id": "30000000-0000-4000-8000-000000000010", "version": "KqlParameterItem/1.0", "name": "ShowDataCoverage", "label": "Data Source Coverage", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[{\"value\": \"Show\", \"label\": \"πŸ“‘ Show\"}, {\"value\": \"Hide\", \"label\": \"🚫 Hide\"}]", "value": "Show", "key": "30000000-0000-4000-8000-000000000010" }, { "id": "20000000-0000-4000-8000-000000000005", "version": "KqlParameterItem/1.0", "name": "SelectedPhases", "label": "Attack Phases", "type": 2, "multiSelect": true, "quote": "", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"value\":\"InitialAccess\",\"label\":\"πŸ”΄ Initial Access\"},\r\n {\"value\":\"Persistence\",\"label\":\"🟑 Persistence\"},\r\n {\"value\":\"DefenseEvasion\",\"label\":\"⚫ Defense Evasion\"},\r\n {\"value\":\"CredentialAccess\",\"label\":\"🟀 Credential Access\"},\r\n {\"value\":\"Discovery\",\"label\":\"πŸ”΅ Discovery\"},\r\n {\"value\":\"LateralMovement\",\"label\":\"🟠 Lateral Movement\"},\r\n {\"value\":\"Exfiltration\",\"label\":\"πŸ”΄ Exfiltration\"}\r\n]", "key": "20000000-0000-4000-8000-000000000005" }, { "id": "30000000-0000-4000-8000-000000000001", "version": "KqlParameterItem/1.0", "name": "isInitialAccessVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "SelectedPhases", "operator": "contains", "rightValType": "static", "rightVal": "InitialAccess", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "key": "30000000-0000-4000-8000-000000000001" }, { "id": "30000000-0000-4000-8000-000000000002", "version": "KqlParameterItem/1.0", "name": "isLateralMovementVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "SelectedPhases", "operator": "contains", "rightValType": "static", "rightVal": "LateralMovement", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "key": "30000000-0000-4000-8000-000000000002" }, { "id": "30000000-0000-4000-8000-000000000003", "version": "KqlParameterItem/1.0", "name": "isPersistenceVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "SelectedPhases", "operator": "contains", "rightValType": "static", "rightVal": "Persistence", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "key": "30000000-0000-4000-8000-000000000003" }, { "id": "30000000-0000-4000-8000-000000000004", "version": "KqlParameterItem/1.0", "name": "isDiscoveryVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "SelectedPhases", "operator": "contains", "rightValType": "static", "rightVal": "Discovery", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "key": "30000000-0000-4000-8000-000000000004" }, { "id": "30000000-0000-4000-8000-000000000005", "version": "KqlParameterItem/1.0", "name": "isDefenseEvasionVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "SelectedPhases", "operator": "contains", "rightValType": "static", "rightVal": "DefenseEvasion", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "key": "30000000-0000-4000-8000-000000000005" }, { "id": "30000000-0000-4000-8000-000000000006", "version": "KqlParameterItem/1.0", "name": "isCredentialAccessVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "SelectedPhases", "operator": "contains", "rightValType": "static", "rightVal": "CredentialAccess", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "key": "30000000-0000-4000-8000-000000000006" }, { "id": "30000000-0000-4000-8000-000000000007", "version": "KqlParameterItem/1.0", "name": "isExfiltrationVisible", "type": 1, "isHiddenWhenLocked": true, "criteriaData": [ { "criteriaContext": { "leftOperand": "SelectedPhases", "operator": "contains", "rightValType": "static", "rightVal": "Exfiltration", "resultValType": "static", "resultVal": "true" } }, { "criteriaContext": { "operator": "Default", "resultValType": "static", "resultVal": "false" } } ], "key": "30000000-0000-4000-8000-000000000007" }, { "id": "20000000-0000-4000-8000-000000000021", "version": "KqlParameterItem/1.0", "name": "UserFilter", "label": "User", "type": 1, "defaultValue": "", "key": "20000000-0000-4000-8000-000000000021" }, { "id": "20000000-0000-4000-8000-000000000022", "version": "KqlParameterItem/1.0", "name": "DeviceFilter", "label": "Device", "type": 1, "defaultValue": "", "key": "20000000-0000-4000-8000-000000000022" }, { "id": "20000000-0000-4000-8000-000000000023", "version": "KqlParameterItem/1.0", "name": "IPFilter", "label": "IP Address", "type": 1, "value": "", "key": "20000000-0000-4000-8000-000000000023" } ], "style": "pills" }, "name": "parameters - 0", "id": "31cf825e-e825-4c59-8463-a957c2a61018" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## πŸ›‘οΈ Hybrid Attack β€” Cloud & Identity Kill-Chain\nBehavior-led hunting for a hybrid identity attack, end-to-end across **7 MITRE ATT&CK phases**: Initial Access β†’ Lateral Movement β†’ Persistence β†’ Discovery β†’ Defense Evasion β†’ Credential Access β†’ Exfiltration. Each tile correlates Entra ID, Azure, on-prem AD, and Defender XDR signals.\n\n**Layout** Β· One collapsible section per phase; most detections pair a *summary* with a *detail* drill-down. Each phase header lists its **MITRE** techniques and **Key tables**. A `βœ… … in this window.` banner means nothing matched β€” a good sign.\n\n**How to use** Β· Set **Workspace** + **Time Range**, then scope with the **Attack Phases** selector and optional **User / Device / IP** filters. Check **Data Source Coverage** (below) first to confirm the required tables have recent data.\n\n> These are *hunting* queries (hypothesis-led), not tuned alerts β€” treat hits as leads to investigate." }, "name": "section-0-readme", "id": "1999f5c4-db91-4094-a2b3-a34f0d9050b1" }, { "type": 1, "content": { "json": "## πŸ“‘ Data Source Coverage\nFreshness of the Sentinel & Defender XDR tables this kill-chain workbook depends on (last 24h). The grid lists each required table with its last-seen time; the honeycomb heatmaps availability at a glance (🟩 Ingesting / πŸŸ₯ No data). Confirm coverage here before triaging the phases below." }, "name": "datacoverage-text", "id": "1ed09e7f-2ef5-408c-bd79-80f73ffe43da" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\n (AADNonInteractiveUserSignInLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AADNonInteractiveUserSignInLogs\", Required=\"Initial Access Β· Discovery\"),\n (AADUserRiskEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AADUserRiskEvents\", Required=\"Initial Access\"),\n (AzureDiagnostics | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AzureDiagnostics\", Required=\"Initial Access Β· Persistence\"),\n (CommonSecurityLog | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CommonSecurityLog\", Required=\"Initial Access\"),\n (SigninLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"SigninLogs\", Required=\"Initial Access Β· Persistence\"),\n (ThreatIntelIndicators | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"ThreatIntelIndicators\", Required=\"Initial Access Β· Exfiltration\"),\n (AADServicePrincipalSignInLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AADServicePrincipalSignInLogs\", Required=\"Persistence Β· Defense Evasion Β· Credential Access\"),\n (AuditLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AuditLogs\", Required=\"Persistence Β· Exfiltration\"),\n (AzureActivity | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AzureActivity\", Required=\"Defense Evasion Β· Credential Access Β· Discovery\"),\n (BehaviorAnalytics | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"BehaviorAnalytics\", Required=\"Defense Evasion\"),\n (CloudAuditEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CloudAuditEvents\", Required=\"Defense Evasion Β· Credential Access\"),\n (CloudProcessEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CloudProcessEvents\", Required=\"Defense Evasion\"),\n (DeviceInfo | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"DeviceInfo\", Required=\"Defense Evasion Β· Lateral Movement\"),\n (DeviceNetworkInfo | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"DeviceNetworkInfo\", Required=\"Defense Evasion\"),\n (CloudStorageAggregatedEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CloudStorageAggregatedEvents\", Required=\"Credential Access\"),\n (CloudAppEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CloudAppEvents\", Required=\"Discovery Β· Exfiltration\"),\n (IdentityInfo | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"IdentityInfo\", Required=\"Lateral Movement\"),\n (StorageBlobLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"StorageBlobLogs\", Required=\"Exfiltration\")\n| project Table, Required, LastSeen = iif(isnotempty(LastSeen),tostring(LastSeen),\"No Data\") //, Status=iff(isnotempty(LastSeen), \"Ingesting\", \"No data\")\n| order by LastSeen desc//, Status desc", "size": 0, "title": "Data Source Coverage (last 24h)", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Status", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "No data", "representation": "redBright", "text": "⚠️ {0}" }, { "operator": "==", "thresholdValue": "Ingesting", "representation": "green", "text": "βœ… {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}" } ] } }, { "columnMatch": "LastSeen", "formatter": 6 } ], "labelSettings": [ { "columnId": "Table", "label": "Data Source" }, { "columnId": "Required", "label": "Required For" }, { "columnId": "LastSeen", "label": "Last Seen" } ] } }, "customWidth": "100", "name": "data-coverage-check", "id": "8268a884-c950-4dce-9975-860255a51bad" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true\n (AADNonInteractiveUserSignInLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AADNonInteractiveUserSignInLogs\", Required=\"Initial Access Β· Discovery\"),\n (AADUserRiskEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AADUserRiskEvents\", Required=\"Initial Access\"),\n (AzureDiagnostics | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AzureDiagnostics\", Required=\"Initial Access Β· Persistence\"),\n (CommonSecurityLog | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CommonSecurityLog\", Required=\"Initial Access\"),\n (SigninLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"SigninLogs\", Required=\"Initial Access Β· Persistence\"),\n (ThreatIntelIndicators | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"ThreatIntelIndicators\", Required=\"Initial Access Β· Exfiltration\"),\n (AADServicePrincipalSignInLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AADServicePrincipalSignInLogs\", Required=\"Persistence Β· Defense Evasion Β· Credential Access\"),\n (AuditLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AuditLogs\", Required=\"Persistence Β· Exfiltration\"),\n (AzureActivity | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"AzureActivity\", Required=\"Defense Evasion Β· Credential Access Β· Discovery Β· Lateral Movement\"),\n (BehaviorAnalytics | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"BehaviorAnalytics\", Required=\"Defense Evasion\"),\n (CloudAuditEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CloudAuditEvents\", Required=\"Defense Evasion Β· Credential Access\"),\n (CloudProcessEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CloudProcessEvents\", Required=\"Defense Evasion\"),\n (DeviceInfo | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"DeviceInfo\", Required=\"Defense Evasion Β· Lateral Movement\"),\n (DeviceNetworkInfo | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"DeviceNetworkInfo\", Required=\"Defense Evasion\"),\n (CloudStorageAggregatedEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CloudStorageAggregatedEvents\", Required=\"Credential Access\"),\n (CloudAppEvents | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"CloudAppEvents\", Required=\"Discovery Β· Exfiltration\"),\n (IdentityInfo | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"IdentityInfo\", Required=\"Lateral Movement\"),\n (StorageBlobLogs | where TimeGenerated > ago(24h) | summarize LastSeen=max(TimeGenerated) | extend Table=\"StorageBlobLogs\", Required=\"Exfiltration\")\n| project Table, Required, LastSeen, Status=iff(isnotempty(LastSeen), \"Ingesting\", \"No data\"), Health=iff(isnotempty(LastSeen), 0, 1)\n| order by Status desc, LastSeen asc", "size": 0, "title": "Data Source Coverage (last 24h) - Honeycomb", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "graph", "graphSettings": { "type": 2, "topContent": { "columnMatch": "Table", "formatter": 1, "formatOptions": { "showIcon": true } }, "centerContent": { "columnMatch": "Status", "formatter": 1, "formatOptions": { "showIcon": true } }, "hivesContent": { "columnMatch": "Table", "formatter": 1, "formatOptions": { "showIcon": true } }, "nodeIdField": "Table", "nodeSize": null, "staticNodeSize": 50, "colorSettings": { "nodeColorField": "Health", "colorAggregation": "Sum", "type": 4, "heatmapPalette": "greenRed", "heatmapMin": 0, "heatmapMax": 1 }, "groupByField": "Table", "hivesMargin": 5 } }, "customWidth": "100", "name": "data-coverage-honeycomb", "id": "2ec7f8b9-32ed-4082-ae02-3bc4078ae92a" } ] }, "showPin": true, "name": "section-1-datacoverage", "id": "321f0020-3d6f-4471-895d-930bc8fd0d99", "conditionalVisibility": { "parameterName": "ShowDataCoverage", "comparison": "isEqualTo", "value": "Show" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## πŸ”΄ Initial Access\nCredential stuffing/spray and risky sign-ins against VPN/network apps, TI-matched appliance traffic, CVE exploitation on edge appliances, web-service RCE with egress, Azure VM IMDS token theft, and first-seen Kubernetes control-plane writes.\n\n**MITRE:** T1110 Β· T1190 Β· T1133 Β· T1078.004 Β· T1059 Β· T1552.005 \n**Key tables:** SigninLogs Β· AADNonInteractiveUserSignInLogs Β· CommonSecurityLog Β· ThreatIntelIndicators Β· _Im_NetworkSession Β· _Im_ProcessEvent Β· AzureDiagnostics" }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "name": "section-2-text", "id": "d369a553-6e98-4f6f-8074-29f2aedb1182" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet failureThreshold = 10;\nlet sprayUserThreshold = 5;\nlet stuffingWindowMinutes = 60;\nlet vpnAppKeywords = dynamic([\n \"GlobalProtect\", \"Palo Alto Networks\", \"Fortinet\",\n \"Cisco AnyConnect\", \"Cisco Secure Client\", \"Zscaler\", \"Pulse Secure\",\n \"Ivanti Connect Secure\", \"Ivanti Secure Access\", \"Ivanti VPN\", \"F5\", \"NetScaler\", \"Citrix Gateway\",\n \"Barracuda VPN\", \"SonicWall\"]);\n// Failure codes that indicate wrong-password attempts (credential stuffing indicators)\n// 50053=AccountLocked, 50126=InvalidPassword, 50056=InvalidPassword(variant),\n// 50064=CredentialValidationFailure, 70000=InvalidGrant\nlet failureCodes = dynamic([50053, 50126, 50056, 50064, 70000]);\nlet Failures =\n union SigninLogs, AADNonInteractiveUserSignInLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where ResultType in (failureCodes)\n | where AppDisplayName has_any (vpnAppKeywords)\n | where IPAddress !in (\"127.0.0.1\", \"::1\", \"0.0.0.0\")\n | project FailTime = TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName;\nlet Successes =\n union\n (SigninLogs | extend LocationDetails = todynamic(LocationDetails)),\n (AADNonInteractiveUserSignInLogs | extend LocationDetails = todynamic(LocationDetails))\n | where TimeGenerated between (StartTime .. EndTime)\n | where ResultType == 0\n | where AppDisplayName has_any (vpnAppKeywords)\n | project\n SuccessTime = TimeGenerated,\n UserPrincipalName,\n UserId,\n IPAddress,\n AppDisplayName,\n RiskLevelDuringSignIn = column_ifexists('RiskLevelDuringSignIn', ''),\n RiskLevelAggregated = column_ifexists('RiskLevelAggregated', ''),\n Country = tostring(LocationDetails.countryOrRegion),\n City = tostring(LocationDetails.city);\n// Pattern A: Credential Stuffing β€” many failures on same user from same IP, then success\nlet PatternA =\n Failures\n | summarize\n FailureCount = count(),\n FirstFailure = min(FailTime),\n LastFailure = max(FailTime)\n by UserPrincipalName, IPAddress, AppDisplayName\n | where FailureCount >= failureThreshold\n | join kind=inner Successes on UserPrincipalName, IPAddress, AppDisplayName\n | where SuccessTime > LastFailure\n | where datetime_diff('minute', SuccessTime, FirstFailure) <= stuffingWindowMinutes\n | summarize arg_min(SuccessTime, *) by UserPrincipalName, IPAddress, AppDisplayName\n | project\n PatternType = \"A β€” Credential Stuffing\",\n SuccessAfterFailuresTime = SuccessTime,\n UserPrincipalName,\n EntraProfileUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/\",UserId),\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", IPAddress,\"/overview\"),\n IPAddress,\n AppDisplayName,\n Country,\n City,\n FailureCount,\n FirstFailure,\n SignalStrength = iff(FailureCount >= 50, \"High\", \"Medium\"),\n RiskLevelDuringSignIn,\n RiskLevelAggregated;\n// Pattern B: Password Spray β€” same IP targets many distinct users, at least one success\nlet PatternB_Failures =\n Failures\n | summarize\n DistinctUsers = dcount(UserPrincipalName),\n FailureCount = count(),\n FirstFailure = min(FailTime),\n LastFailure = max(FailTime),\n UserSample = make_set(UserPrincipalName)\n by IPAddress, AppDisplayName;\nlet PatternB =\n PatternB_Failures\n | where DistinctUsers >= sprayUserThreshold\n | join kind=inner Successes on IPAddress, AppDisplayName\n | where SuccessTime > LastFailure\n | where datetime_diff('minute', SuccessTime, FirstFailure) <= stuffingWindowMinutes\n | summarize arg_min(SuccessTime, *) by IPAddress, AppDisplayName, UserPrincipalName\n // Success user must be one of the sprayed accounts β€” avoids FP from unrelated logins on shared IPs\n | where array_index_of(UserSample, UserPrincipalName) != -1\n | project\n PatternType = \"B β€” Password Spray\",\n SuccessAfterFailuresTime = SuccessTime,\n UserPrincipalName,\n EntraProfileUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/\",UserId),\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", IPAddress,\"/overview\"),\n IPAddress,\n AppDisplayName,\n Country,\n City,\n FailureCount,\n DistinctUsers,\n FirstFailure,\n SignalStrength = iff(DistinctUsers >= 20, \"High\", \"Medium\"),\n RiskLevelDuringSignIn,\n RiskLevelAggregated;\nunion PatternA, PatternB\n| where isempty('{UserFilter}') or UserPrincipalName contains '{UserFilter}'\n| where isempty('{IPFilter}') or IPAddress contains '{IPFilter}'\n| extend TimeDeltaMinutes = datetime_diff('minute', SuccessAfterFailuresTime, FirstFailure)\n| sort by SignalStrength asc, SuccessAfterFailuresTime desc\n| project-reorder SignalStrength, PatternType, UserPrincipalName, IPAddress, AppDisplayName, FailureCount, DistinctUsers, TimeDeltaMinutes, FirstFailure, SuccessAfterFailuresTime, RiskLevelDuringSignIn, EntraProfileUrl, XDRIPUrl\n| limit 25", "size": 0, "title": "VPN Credential Stuffing & Spray (Pattern A: Stuffing / Pattern B: Spray)", "noDataMessage": "βœ… No VPN credential-stuffing or spray patterns in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SignalStrength", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "FailureCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "50", "representation": "redBright", "text": "🚨 {0}" }, { "operator": ">=", "thresholdValue": "10", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "DistinctUsers", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "20", "representation": "redBright", "text": "🚨 {0}" }, { "operator": ">=", "thresholdValue": "5", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "RiskLevelDuringSignIn", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "==", "thresholdValue": "low", "representation": "yellow", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "RiskLevelAggregated", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "==", "thresholdValue": "low", "representation": "yellow", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "TimeDeltaMinutes", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0} min" }, { "operator": "<=", "thresholdValue": "60", "representation": "orange", "text": "⚠️ {0} min" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0} min" } ] } }, { "columnMatch": "EntraProfileUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ‘€ View User", "linkIsContextBlade": false } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP", "linkIsContextBlade": false } }, { "columnMatch": "FirstFailure", "formatter": 6 }, { "columnMatch": "SuccessAfterFailuresTime", "formatter": 6 } ], "labelSettings": [ { "columnId": "SignalStrength", "label": "Signal" }, { "columnId": "PatternType", "label": "Pattern" }, { "columnId": "UserPrincipalName", "label": "User (UPN)" }, { "columnId": "IPAddress", "label": "Source IP" }, { "columnId": "AppDisplayName", "label": "VPN/ZTNA App" }, { "columnId": "FailureCount", "label": "Failures" }, { "columnId": "DistinctUsers", "label": "Distinct Users" }, { "columnId": "TimeDeltaMinutes", "label": "Failβ†’Success (min)" }, { "columnId": "FirstFailure", "label": "First Failure" }, { "columnId": "SuccessAfterFailuresTime", "label": "Success Time" }, { "columnId": "RiskLevelDuringSignIn", "label": "Risk (Sign-in)" }, { "columnId": "EntraProfileUrl", "label": "Entra" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "RiskLevelAggregated", "label": "Risk (Aggregated)" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "name": "ia-q5-credential-stuffing", "id": "aebd722a-90dc-425c-9833-c07a44137fb4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet correlationWindowMinutes = 60; // risk event must occur within this window of the sign-in\n let vpnAppKeywords = dynamic([\"GlobalProtect\", \"Palo Alto Networks\", \"Fortinet\", \"Cisco AnyConnect\", \"Cisco Secure Client\", \"Zscaler\", \"Pulse Secure\",\n \"Ivanti Connect Secure\", \"Ivanti Secure Access\", \"Ivanti VPN\", \"F5\", \"NetScaler\", \"Citrix Gateway\", \n \"Barracuda VPN\", \"SonicWall\"]);\nlet highValueRiskTypes = dynamic([\n \"leakedCredentials\",\n \"investigationsThreatIntelligence\",\n \"mcasImpossibleTravel\",\n \"unlikelyTravel\",\n \"anonymizedIPAddress\",\n \"maliciousIPAddress\",\n \"unfamiliarFeatures\"]);\n// Successful VPN logins\nlet VPNLogins =\n SigninLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where ResultType == 0\n | where AppDisplayName has_any (vpnAppKeywords)\n | project\n SignInTime = TimeGenerated,\n UserPrincipalName,\n IPAddress,\n AppDisplayName,\n Country = tostring(LocationDetails.countryOrRegion),\n City = tostring(LocationDetails.city),\n ConditionalAccessStatus;\n// Risk detection events for same period\n// RiskState filter: exclude already-remediated/dismissed events to avoid FPs\n// from risks Entra ID has already auto-resolved (e.g., user passed MFA challenge)\nlet RiskEvents =\n AADUserRiskEvents\n | where TimeGenerated between (StartTime .. EndTime)\n | where RiskLevel in (\"high\", \"medium\")\n | where RiskEventType in (highValueRiskTypes)\n | where RiskState in (\"atRisk\", \"confirmedCompromised\") // exclude remediated/dismissed/confirmedSafe\n | project\n RiskTime = coalesce(ActivityDateTime, TimeGenerated),\n UserPrincipalName,\n RiskEventType,\n RiskLevel,\n RiskDetail,\n RiskState;\n// Join: VPN login correlated with a risk event for same user within riskWindow\nVPNLogins\n| join kind=inner RiskEvents on UserPrincipalName\n| where abs(datetime_diff('minute', SignInTime, RiskTime)) <= correlationWindowMinutes\n| summarize arg_min(RiskTime, *) by UserPrincipalName, SignInTime, IPAddress, AppDisplayName\n| project\n SignInTime,\n UserPrincipalName,\n IPAddress,\n AppDisplayName,\n Country,\n City,\n RiskEventType,\n RiskLevel,\n RiskDetail,\n RiskState,\n RiskTime,\n ConditionalAccessStatus\n| extend AccountName = tostring(split(UserPrincipalName, \"@\")[0])\n| extend AccountUPNSuffix = tostring(split(UserPrincipalName, \"@\")[1])\n| where isempty('{UserFilter}') or UserPrincipalName contains '{UserFilter}'\n| where isempty('{IPFilter}') or IPAddress contains '{IPFilter}'\n| summarize Count = count(), AffectedUsers = dcount(UserPrincipalName) by RiskEventType, RiskLevel\n| sort by Count desc\n| render barchart", "size": 0, "title": "Risky Successful Sign-in to VPN/Network App (by Risk Event Type)", "noDataMessage": "βœ… No risky VPN/network-app sign-ins correlated with Entra risk events in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "xAxis": "RiskEventType", "yAxis": [ "Count" ], "group": "RiskLevel", "createOtherGroup": null, "showDataLabels": true, "seriesLabelSettings": [ { "seriesName": "high", "color": "red" }, { "seriesName": "medium", "color": "orange" }, { "seriesName": "low", "color": "yellow" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ia-q6-risky-vpn-signin", "id": "c472db33-79e8-4d41-9b1a-3e93d6970926" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet postExploitWindow = 15m;\n// Known CVE exploitation URL path signatures β€” extracted from CISA advisories\n// Note: /../ removed (too generic β€” matches any path traversal detected by firewall)\nlet CVEUrlPaths = dynamic([\n \"/api/v1/totp/user-backup-code/\", // CVE-2023-46805 β€” Ivanti auth bypass\n \"/api/v1/license/keys-status/\", // CVE-2024-21887 β€” Ivanti RCE (keys-status is plural)\n \"/api/v2/cmdb/system/admin/\", // CVE-2022-40684 β€” Fortinet auth bypass\n \"/vpns/page.aspx\", // CVE-2019-19781 β€” Citrix ADC directory traversal RCE\n \"/remote/fgt_lang?lang=\" // CVE-2018-13379 β€” Fortinet SSL VPN path traversal\n]);\nlet ApplianceVendors = dynamic([\n \"Fortinet\", \"Palo Alto Networks\", \"Ivanti\", \"Pulse Secure\",\n \"SonicWall\", \"Cisco\", \"Check Point\", \"Juniper\", \"F5\", \"Citrix\"]);\n// Method 1: Known CVE exploitation URL paths in request or message\nlet CVE_URL_Hits =\n CommonSecurityLog\n | where TimeGenerated between (StartTime .. EndTime)\n | where DeviceVendor in~ (ApplianceVendors)\n // Exclude F5 ASM β€” WAF detecting attacks against protected apps, not F5 being exploited\n | where DeviceProduct !has \"ASM\"\n | where RequestURL has_any (CVEUrlPaths)\n or Message has_any (CVEUrlPaths)\n // Exclude Qualys/Nessus scanner probes\n | where Message !has \"Qualys\" and Message !has \"nessus\"\n | extend CVEReference = case(\n RequestURL contains \"totp/user-backup-code\" or Message contains \"totp/user-backup-code\", \"CVE-2023-46805 (Ivanti auth bypass)\",\n RequestURL contains \"license/keys-status\" or Message contains \"license/keys-status\", \"CVE-2024-21887 (Ivanti RCE)\",\n RequestURL contains \"/api/v2/cmdb/system/admin\" or Message contains \"/api/v2/cmdb/system/admin\", \"CVE-2022-40684 (Fortinet auth bypass)\",\n RequestURL contains \"vpns/page.aspx\" or Message contains \"vpns/page.aspx\", \"CVE-2019-19781 (Citrix ADC directory traversal RCE)\",\n RequestURL contains \"fgt_lang\" or Message contains \"fgt_lang\", \"CVE-2018-13379 (Fortinet SSL VPN path traversal)\",\n \"Unknown CVE path\")\n | project\n EventTime = TimeGenerated,\n DetectionMethod = \"Method1 β€” CVE URL path\",\n CVEReference,\n SourceIP,\n DestinationIP,\n SourceUserName,\n DeviceVendor,\n DeviceProduct,\n DeviceAction,\n Activity,\n RequestURL,\n Message,\n Computer,\n SignalStrength = \"High β€” known CVE exploit path matched\";\n// Method 2: CVE ID string in appliance log message (vendor IPS catch-all)\nlet CVE_String_Hits =\n CommonSecurityLog\n | where TimeGenerated between (StartTime .. EndTime)\n | where DeviceVendor in~ (ApplianceVendors)\n | where Message contains \"CVE-20\"\n // Exclude noise sources (RDA-validated):\n | where Message !has \"nessus.org\" // Nessus scanner DNS callbacks embedding CVE in hostname\n and Message !has \"430002\" // Cisco FTD connection logs (traffic allowed, not threat)\n and DeviceProduct != \"Cortex XDR\" // Endpoint detections, not appliance exploit indicators\n and DeviceProduct !has \"ASM\" // F5 WAF detecting attacks against protected apps\n | extend CVEReference = extract(@\"(CVE-\\d{4}-\\d+)\", 1, Message)\n | where isnotempty(CVEReference)\n | project\n EventTime = TimeGenerated,\n DetectionMethod = \"Method2 β€” CVE string in log\",\n CVEReference,\n SourceIP,\n DestinationIP,\n SourceUserName,\n DeviceVendor,\n DeviceProduct,\n DeviceAction,\n Activity,\n RequestURL,\n Message,\n Computer,\n SignalStrength = \"Medium β€” CVE reference in log message\"\n | summarize arg_min(EventTime, *) by SourceIP, DestinationIP, CVEReference, Computer;\n// Method 3: FortiGate SAML/SSO bypass β†’ local admin account creation (FG-IR-26-060)\n// Translated from Elastic \"FortiGate SSO Login Followed by Administrator Account Creation\"\n// RDA-validated: FSSO-logon is the correct DeviceAction for FortiGate SSO events\nlet Forti_SSO_Logins =\n CommonSecurityLog\n | where TimeGenerated between (StartTime .. EndTime)\n | where DeviceVendor =~ \"Fortinet\"\n | where DeviceAction == \"FSSO-logon\"\n | project SSOTime = TimeGenerated, Computer, SourceIP;\nlet Forti_AdminCreate =\n CommonSecurityLog\n | where TimeGenerated between (StartTime .. EndTime)\n | where DeviceVendor =~ \"Fortinet\"\n | where DeviceEventClassID == \"0100044547\"\n | where Message has \"system.admin\" and Message has \"Add\"\n | project AdminCreateTime = TimeGenerated, Computer, AdminMessage = Message;\nlet Forti_Sequence =\n Forti_SSO_Logins\n | join kind=inner Forti_AdminCreate on Computer\n | where AdminCreateTime > SSOTime\n and AdminCreateTime < SSOTime + postExploitWindow\n | project\n EventTime = SSOTime,\n DetectionMethod = \"Method3 β€” FortiCloud SSO auth bypass + admin create (FG-IR-26-060)\",\n CVEReference = \"CVE-2026-24858 (FortiCloud SSO authentication bypass)\",\n SourceIP,\n DestinationIP = \"\",\n SourceUserName = \"\",\n DeviceVendor = \"Fortinet\",\n DeviceProduct = \"\",\n DeviceAction = \"SSO login β†’ admin create\",\n Activity = strcat(\"Admin created at \", tostring(AdminCreateTime)),\n RequestURL = \"\",\n Message = AdminMessage,\n Computer,\n SignalStrength = \"High β€” SSO bypass then admin account created within 15 min\"\n | summarize arg_min(EventTime, *) by SourceIP, Computer, CVEReference;\n// Combine all methods\nunion CVE_URL_Hits, CVE_String_Hits, Forti_Sequence\n| where isempty('{IPFilter}') or SourceIP contains '{IPFilter}'\n| where isempty('{UserFilter}') or SourceUserName contains '{UserFilter}'\n| where isempty('{DeviceFilter}') or Computer contains '{DeviceFilter}'\n| extend SignalCategory = tostring(split(SignalStrength, \" β€” \")[0]) // extracts \"High\"/\"Medium\"\n| summarize\n Count = count(),\n AffectedDevices = dcount(Computer),\n UniqueSourceIPs = dcount(SourceIP)\n by CVEReference, SignalCategory\n | sort by Count desc\n | render barchart", "size": 0, "title": "CVE Exploitation on Network Appliance (by CVE Reference)", "noDataMessage": "βœ… No CVE-exploitation indicators on appliance traffic in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "xAxis": "CVEReference", "yAxis": [ "Count" ], "group": "SignalCategory", "showDataLabels": true, "seriesLabelSettings": [ { "seriesName": "High", "color": "red" }, { "seriesName": "Medium", "color": "orange" } ] } }, "customWidth": "50", "name": "ia-q9-cve-exploitation", "id": "3eeda97b-7f1e-4600-bc96-4d84bad5794a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\n// New table (ThreatIntelIndicators) uses STIX 2.1 schema:\n// ObservableKey = STIX property path (e.g. \"ipv4-addr:value\", \"network-traffic:src_ref.value\")\n// ObservableValue = the actual IP string\n// ThreatIntelligenceIndicator is deprecated β€” stopped ingesting data July 31 2025\nlet TIIPs =\n ThreatIntelIndicators\n | where IsActive == true\n | where IsDeleted == false\n | where ValidUntil > now()\n | where Confidence >= 50 or isnull(Confidence) or Confidence == 0\n | where ObservableKey in (\"ipv4-addr:value\", \"network-traffic:src_ref.value\", \"network-traffic:dst_ref.value\")\n | where isnotempty(ObservableValue)\n | summarize\n MaxConfidence = max(Confidence),\n Tags = take_any(Tags)\n by TI_IP = ObservableValue;\n// 3P appliance vendors in scope for hybrid attack scenario\nlet ApplianceVendors = dynamic([\n \"Fortinet\", \"Palo Alto Networks\", \"Ivanti\", \"Pulse Secure\",\n \"SonicWall\", \"Cisco\", \"Check Point\", \"Juniper\", \"F5\", \"Citrix\"]);\n// Direction 1: Inbound β€” attacker-controlled IP connecting to/through appliance\n// Maps to S1 (portal compromise) and S3 (VPN login from attacker IP)\nlet InboundTIHits =\n CommonSecurityLog\n | where TimeGenerated between (StartTime .. EndTime)\n | where DeviceVendor in~ (ApplianceVendors)\n | where isnotempty(SourceIP)\n | where SourceIP !in (\"127.0.0.1\", \"::1\", \"0.0.0.0\")\n | join kind=inner TIIPs on $left.SourceIP == $right.TI_IP\n | project\n EventTime = TimeGenerated,\n Direction = \"Inbound β€” attacker to appliance\",\n TI_IP = SourceIP,\n CounterpartIP = DestinationIP,\n DeviceVendor,\n DeviceProduct,\n Activity,\n DeviceAction,\n SourceUserName,\n DestinationUserName,\n SourcePort,\n DestinationPort,\n ApplicationProtocol,\n Message,\n Computer,\n MaxConfidence,\n Tags,\n ActionTaken = iff(DeviceAction =~ \"Block\", \"Blocked βœ“\", \"⚠️ Allowed\");\n// Direction 2: Outbound β€” appliance beaconing to TI-matched C2 destination\n// Maps to S5 (implant deployed, maintains C2 channel)\nlet OutboundTIHits =\n CommonSecurityLog\n | where TimeGenerated between (StartTime .. EndTime)\n | where DeviceVendor in~ (ApplianceVendors)\n | where isnotempty(DestinationIP)\n | where DestinationIP !in (\"127.0.0.1\", \"::1\", \"0.0.0.0\")\n | join kind=inner TIIPs on $left.DestinationIP == $right.TI_IP\n | project\n EventTime = TimeGenerated,\n Direction = \"Outbound β€” appliance to C2\",\n TI_IP = DestinationIP,\n CounterpartIP = SourceIP,\n DeviceVendor,\n DeviceProduct,\n Activity,\n DeviceAction,\n SourceUserName,\n DestinationUserName,\n SourcePort,\n DestinationPort,\n ApplicationProtocol,\n Message,\n Computer,\n MaxConfidence,\n Tags,\n ActionTaken = iff(DeviceAction =~ \"Block\", \"Blocked βœ“\", \"⚠️ Allowed\");\n// Combine both directions\nunion InboundTIHits, OutboundTIHits\n| extend SignalStrength = case(\n Direction startswith \"Outbound\" and ActionTaken == \"⚠️ Allowed\" and MaxConfidence >= 75,\n \"High β€” active C2 callback, NOT blocked\",\n Direction startswith \"Outbound\" and ActionTaken == \"Blocked βœ“\" and MaxConfidence >= 75,\n \"High β€” C2 attempt blocked\",\n Direction startswith \"Inbound\" and ActionTaken == \"⚠️ Allowed\" and MaxConfidence >= 75,\n \"High β€” known attacker IP, allowed through\",\n Direction startswith \"Inbound\" and ActionTaken == \"Blocked βœ“\",\n \"Medium β€” known attacker IP, blocked\",\n MaxConfidence >= 50, \n \"Medium β€” TI match, medium confidence\",\n \"Low β€” review TI source quality\")\n| extend Severity = tostring(split(SignalStrength, \" \")[0])\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", TI_IP, \"/overview\")\n// Keep first and last event, plus count\n | summarize\n FirstSeen = min(EventTime),\n LastSeen = max(EventTime),\n HitCount = count(),\n Actions = make_set(DeviceAction),\n arg_max(EventTime, *) // keep latest row's other columns\n by TI_IP, Direction, DeviceVendor, Computer\n| where isempty('{IPFilter}') or TI_IP contains '{IPFilter}'\n| where isempty('{UserFilter}') or SourceUserName contains '{UserFilter}'\n| where isempty('{DeviceFilter}') or Computer contains '{DeviceFilter}'\n| project-reorder SignalStrength, Severity, Direction, ActionTaken, TI_IP, XDRIPUrl,\n MaxConfidence, Tags, DeviceVendor, DeviceProduct, CounterpartIP,\n SourceUserName, DestinationUserName, ApplicationProtocol,\n Computer, Activity, Message, EventTime\n| sort by MaxConfidence desc, EventTime desc\n| limit 25", "size": 0, "title": "TI-Matched IP on Network Appliance (Inbound vs Outbound)", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "noDataMessage": "βœ… No TI-matched appliance traffic in this window.", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "πŸ”΄ {0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "ActionTaken", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "⚠️ Allowed", "representation": "redBright", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "MaxConfidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "75", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "HitCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "FirstSeen", "formatter": 6 }, { "columnMatch": "LastSeen", "formatter": 6 }, { "columnMatch": "EventTime", "formatter": 6 } ], "labelSettings": [ { "columnId": "Severity", "label": "Severity" }, { "columnId": "SignalStrength", "label": "Signal (detail)" }, { "columnId": "Direction", "label": "Direction" }, { "columnId": "ActionTaken", "label": "Action" }, { "columnId": "TI_IP", "label": "TI-Matched IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "MaxConfidence", "label": "TI Confidence" }, { "columnId": "Tags", "label": "TI Tags" }, { "columnId": "DeviceVendor", "label": "Appliance Vendor" }, { "columnId": "DeviceProduct", "label": "Product" }, { "columnId": "CounterpartIP", "label": "Counterpart IP" }, { "columnId": "SourceUserName", "label": "Source User" }, { "columnId": "DestinationUserName", "label": "Dest User" }, { "columnId": "ApplicationProtocol", "label": "Protocol" }, { "columnId": "Computer", "label": "Appliance Host" }, { "columnId": "HitCount", "label": "Hits" }, { "columnId": "FirstSeen", "label": "First Seen" }, { "columnId": "LastSeen", "label": "Last Seen" }, { "columnId": "EventTime", "label": "Last Event" } ] } }, "customWidth": "100", "name": "ia-q7-ti-matched-ip", "id": "5452f31c-276b-4471-a2a5-4ae5833e8ef6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\n// Parent processes commonly associated with web-facing services.\nlet WebServiceParents = dynamic([\n \"w3wp.exe\", \"httpd.exe\", \"nginx.exe\", \"apache2\", \"tomcat9.exe\",\n \"java.exe\", \"java\", \"node.exe\", \"dotnet.exe\", \"php-cgi.exe\", \"php.exe\"\n]);\n// Child processes and utilities frequently seen in post-exploitation chains.\nlet RareChildProcesses = dynamic([\n \"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"sh\", \"bash\", \"curl\", \"wget\",\n \"certutil.exe\", \"bitsadmin.exe\", \"mshta.exe\", \"rundll32.exe\", \"python.exe\", \"python3\"\n]);\n// Command-line indicators that suggest staging, download, or shell launch behavior.\nlet EgressIndicators = dynamic([\"http://\", \"https://\", \"-enc\", \"/c \", \"/bin/sh\", \"wget \", \"curl \"]);\n// Find suspicious child process executions launched by web-service parents.\nlet RareChildren =\n _Im_ProcessEvent(starttime=StartTime,endtime=EndTime)\n | where EventType =~ \"ProcessCreated\"\n | extend ParentProcess = tolower(coalesce(ActingProcessFilename, ActingProcessFileOriginalName)),\n ChildProcess = tolower(coalesce(TargetProcessFilename, TargetProcessFileOriginalName)),\n ChildCommandLine = coalesce(TargetProcessCommandLine, \"\")\n | where ParentProcess in~ (WebServiceParents)\n | where ChildProcess in~ (RareChildProcesses)\n or ChildCommandLine has_any (EgressIndicators)\n | project ProcessTime = TimeGenerated,\n DeviceId = tostring(coalesce(DvcId, DvcHostname)),\n DeviceName = coalesce(DvcHostname, DvcFQDN),\n InitiatingProcessFileName = ParentProcess,\n InitiatingProcessCommandLine = tostring(ActingProcessCommandLine),\n FileName = ChildProcess,\n ProcessCommandLine = ChildCommandLine;\n// Capture successful outbound connections to public (non-private) IP space.\nlet OutboundConnections =\n _Im_NetworkSession(starttime=StartTime,endtime=EndTime)\n | where isnotempty(DstIpAddr)\n | where not(\n ipv4_is_in_range(DstIpAddr, \"10.0.0.0/8\")\n or ipv4_is_in_range(DstIpAddr, \"172.16.0.0/12\")\n or ipv4_is_in_range(DstIpAddr, \"192.168.0.0/16\")\n or ipv4_is_in_range(DstIpAddr, \"127.0.0.0/8\")\n or ipv4_is_in_range(DstIpAddr, \"169.254.0.0/16\")\n )\n | where EventResult !~ \"Failure\"\n | project DeviceId = tostring(coalesce(DvcId, DvcHostname)),\n RemoteIP = DstIpAddr,\n RemotePort = DstPortNumber,\n NetworkTime = TimeGenerated;\n// Correlate suspicious child execution with near-term public egress on the same host.\nRareChildren\n| join kind=innerunique OutboundConnections on DeviceId\n| where NetworkTime between (ProcessTime .. (ProcessTime + 5m))\n| extend TimeGenerated = ProcessTime\n| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,\n FileName, ProcessCommandLine, RemoteIP, RemotePort\n| where isempty('{IPFilter}') or RemoteIP contains '{IPFilter}'\n| where isempty('{DeviceFilter}') or DeviceName contains '{DeviceFilter}'\n| summarize\n Count = count(),\n UniqueChildren = dcount(FileName),\n UniqueRemoteIPs = dcount(RemoteIP)\n by DeviceName\n| top 10 by Count desc\n| render barchart", "size": 0, "title": "Web Service Child Process with Egress (Top Affected Servers)", "noDataMessage": "βœ… No web-service RCEβ†’egress chains in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "xAxis": "DeviceName", "yAxis": [ "Count" ], "seriesLabelSettings": [ { "seriesName": "Count", "color": "red" } ], "showDataLabels": true } }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ia-r1-web-child-process", "id": "3201e1b6-1623-43d0-95e5-7c8ebf6da377" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\n// Parent processes commonly associated with web-facing services.\nlet WebServiceParents = dynamic([\n \"w3wp.exe\", \"httpd.exe\", \"nginx.exe\", \"apache2\", \"tomcat9.exe\",\n \"java.exe\", \"java\", \"node.exe\", \"dotnet.exe\", \"php-cgi.exe\", \"php.exe\"\n]);\n// Child processes and utilities frequently seen in post-exploitation chains.\nlet RareChildProcesses = dynamic([\n \"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"sh\", \"bash\", \"curl\", \"wget\",\n \"certutil.exe\", \"bitsadmin.exe\", \"mshta.exe\", \"rundll32.exe\", \"python.exe\", \"python3\"\n]);\n// Command-line indicators that suggest staging, download, or shell launch behavior.\nlet EgressIndicators = dynamic([\"http://\", \"https://\", \"-enc\", \"/c \", \"/bin/sh\", \"wget \", \"curl \"]);\n// Find suspicious child process executions launched by web-service parents.\nlet RareChildren =\n _Im_ProcessEvent(starttime=StartTime,endtime=EndTime)\n | where EventType =~ \"ProcessCreated\"\n | extend ParentProcess = tolower(coalesce(ActingProcessFilename, ActingProcessFileOriginalName)),\n ChildProcess = tolower(coalesce(TargetProcessFilename, TargetProcessFileOriginalName)),\n ChildCommandLine = coalesce(TargetProcessCommandLine, \"\")\n | where ParentProcess in~ (WebServiceParents)\n | where ChildProcess in~ (RareChildProcesses)\n or ChildCommandLine has_any (EgressIndicators)\n | project ProcessTime = TimeGenerated,\n DeviceId = tostring(coalesce(DvcId, DvcHostname)),\n DeviceName = coalesce(DvcHostname, DvcFQDN),\n InitiatingProcessFileName = ParentProcess,\n InitiatingProcessCommandLine = tostring(ActingProcessCommandLine),\n FileName = ChildProcess,\n ProcessCommandLine = ChildCommandLine;\n// Capture successful outbound connections to public (non-private) IP space.\nlet OutboundConnections =\n _Im_NetworkSession(starttime=StartTime,endtime=EndTime)\n | where isnotempty(DstIpAddr)\n | where not(\n ipv4_is_in_range(DstIpAddr, \"10.0.0.0/8\")\n or ipv4_is_in_range(DstIpAddr, \"172.16.0.0/12\")\n or ipv4_is_in_range(DstIpAddr, \"192.168.0.0/16\")\n or ipv4_is_in_range(DstIpAddr, \"127.0.0.0/8\")\n or ipv4_is_in_range(DstIpAddr, \"169.254.0.0/16\")\n )\n | where EventResult !~ \"Failure\"\n | project DeviceId = tostring(coalesce(DvcId, DvcHostname)),\n RemoteIP = DstIpAddr,\n RemotePort = DstPortNumber,\n NetworkTime = TimeGenerated;\n// Correlate suspicious child execution with near-term public egress on the same host.\nRareChildren\n| join kind=innerunique OutboundConnections on DeviceId\n| where NetworkTime between (ProcessTime .. (ProcessTime + 5m))\n| extend TimeGenerated = ProcessTime\n| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,\n FileName, ProcessCommandLine, RemoteIP, RemotePort\n| where isempty('{IPFilter}') or RemoteIP contains '{IPFilter}'\n| where isempty('{DeviceFilter}') or DeviceName contains '{DeviceFilter}'\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", RemoteIP, \"/overview\")\n| order by TimeGenerated desc\n| limit 25", "size": 0, "title": "Web Service Child Process with Egress - Detailed", "noDataMessage": "βœ… No web-service RCEβ†’egress chains in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Process Time" }, { "columnId": "DeviceName", "label": "Server" }, { "columnId": "InitiatingProcessFileName", "label": "Web Parent Process" }, { "columnId": "InitiatingProcessCommandLine", "label": "Parent Cmdline" }, { "columnId": "FileName", "label": "Child Process" }, { "columnId": "ProcessCommandLine", "label": "Child Cmdline" }, { "columnId": "RemoteIP", "label": "Egress IP" }, { "columnId": "RemotePort", "label": "Egress Port" }, { "columnId": "XDRIPUrl", "label": "XDR" } ] } }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ia-r1-web-child-process-detail", "id": "02cdade8-7850-4132-ac2f-9e782f1084e9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n // Parent processes commonly associated with web or app services.\n let ServiceParents = dynamic([\n \"w3wp.exe\", \"httpd.exe\", \"nginx.exe\", \"apache2\", \"tomcat9.exe\", \"tomcat\",\n \"java.exe\", \"java\", \"node.exe\", \"dotnet.exe\", \"php-cgi.exe\", \"php.exe\"\n ]);\n // Child processes and utilities often used after code execution.\n let SuspiciousChildren = dynamic([\n \"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"sh\", \"bash\", \"curl\", \"wget\",\n \"certutil.exe\", \"bitsadmin.exe\", \"mshta.exe\", \"rundll32.exe\", \"python.exe\", \"python3\"\n ]);\n // Command-line tokens that suggest staging, download, or shell execution.\n let StagingTokens = dynamic([\"http://\", \"https://\", \" -enc \", \" /c \", \" /bin/sh\", \"wget \", \"curl \"]);\n // Suspicious execution chain: service parent spawning risky child process/command.\n let SuspiciousExec =\n _Im_ProcessEvent(starttime=StartTime,endtime=EndTime)\n | where EventType =~ \"ProcessCreated\"\n | extend ParentProcess = tolower(coalesce(ActingProcessFilename, ActingProcessFileOriginalName)),\n ChildProcess = tolower(coalesce(TargetProcessFilename, TargetProcessFileOriginalName)),\n ChildCommandLine = coalesce(TargetProcessCommandLine, \"\")\n | where ParentProcess in~ (ServiceParents)\n | where ChildProcess in~ (SuspiciousChildren) or ChildCommandLine has_any (StagingTokens)\n | project ExecTime = TimeGenerated,\n DeviceId = tostring(coalesce(DvcId, DvcHostname)),\n DeviceName = coalesce(DvcHostname, DvcFQDN),\n FileName = ChildProcess,\n ProcessCommandLine = ChildCommandLine,\n InitiatingProcessFileName = ParentProcess,\n InitiatingProcessCommandLine = tostring(ActingProcessCommandLine);\n // Access to Azure IMDS endpoint, commonly used to request managed identity tokens.\n let ImdsAccess =\n _Im_NetworkSession(starttime=StartTime,endtime=EndTime)\n | where DstIpAddr == \"169.254.169.254\"\n | where EventResult !~ \"Failure\"\n | project DeviceId = tostring(coalesce(DvcId, DvcHostname)),\n ImdsTime = TimeGenerated,\n ImdsRemotePort = DstPortNumber,\n ImdsRemoteUrl = tostring(EventReportUrl);\n // Optional confidence booster: near-term outbound public egress from same host.\n let PublicEgress =\n _Im_NetworkSession(starttime=StartTime, endtime=EndTime)\n | where isnotempty(DstIpAddr)\n | where not(\n ipv4_is_in_range(DstIpAddr, \"10.0.0.0/8\")\n or ipv4_is_in_range(DstIpAddr, \"172.16.0.0/12\")\n or ipv4_is_in_range(DstIpAddr, \"192.168.0.0/16\")\n or ipv4_is_in_range(DstIpAddr, \"127.0.0.0/8\")\n or ipv4_is_in_range(DstIpAddr, \"169.254.0.0/16\")\n )\n | where EventResult !~ \"Failure\"\n | project DeviceId = tostring(coalesce(DvcId, DvcHostname)),\n EgressTime = TimeGenerated,\n RemoteIP = DstIpAddr,\n RemotePort = DstPortNumber,\n RemoteUrl = tostring(EventReportUrl);\n // Correlate suspicious process execution to IMDS access in a short time window.\n SuspiciousExec\n | join kind=innerunique ImdsAccess on DeviceId\n | where ImdsTime between (ExecTime .. (ExecTime + 10m))\n // Attach optional public egress shortly after execution.\n | join kind=leftouter PublicEgress on DeviceId\n | where isempty(EgressTime) or EgressTime between (ExecTime .. (ExecTime + 15m))\n // Escalate confidence if both IMDS and public egress are observed.\n | extend Confidence = iff(isempty(EgressTime), \"High\", \"Critical\")\n | extend TimeGenerated = ExecTime\n | project TimeGenerated, Confidence, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,\n FileName, ProcessCommandLine, ImdsTime, ImdsRemotePort, ImdsRemoteUrl, EgressTime, RemoteIP, RemotePort, RemoteUrl\n | where isempty('{IPFilter}') or RemoteIP contains '{IPFilter}'\n | where isempty('{DeviceFilter}') or DeviceName contains '{DeviceFilter}'\n | project-reorder Confidence, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, DeviceName, RemoteIP, RemotePort, ImdsTime, ImdsRemotePort, EgressTime, TimeGenerated\n | order by Confidence asc, TimeGenerated desc\n | limit 25", "size": 0, "title": "Azure VM web process to IMDS token theft chain", "noDataMessage": "βœ… No IMDS token-theft chains in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "Confidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "High", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "ImdsTime", "formatter": 6 }, { "columnMatch": "EgressTime", "formatter": 6 }, { "columnMatch": "TimeGenerated", "formatter": 6 } ], "labelSettings": [ { "columnId": "Confidence", "label": "Confidence" }, { "columnId": "InitiatingProcessFileName", "label": "Web Parent Process" }, { "columnId": "InitiatingProcessCommandLine", "label": "Parent Cmdline" }, { "columnId": "FileName", "label": "Child Process" }, { "columnId": "ProcessCommandLine", "label": "Child Cmdline" }, { "columnId": "DeviceName", "label": "Azure VM" }, { "columnId": "RemoteIP", "label": "Egress IP" }, { "columnId": "RemotePort", "label": "Egress Port" }, { "columnId": "ImdsTime", "label": "IMDS Access Time" }, { "columnId": "ImdsRemotePort", "label": "IMDS Port" }, { "columnId": "EgressTime", "label": "Egress Time" }, { "columnId": "TimeGenerated", "label": "Exec Time" } ] } }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ia-r2-imds-token-theft", "id": "e3e43e84-c7d7-4488-9d47-162e76d2c48f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineStart = StartTime - 14d;\nlet BaselineEnd = StartTime;\nlet SensitiveWriteOps = dynamic([\n \"clusterrolebindings/create\", \"clusterrolebindings/patch\", \"clusterrolebindings/update\",\n \"rolebindings/create\", \"rolebindings/patch\", \"rolebindings/update\",\n \"daemonsets/create\", \"cronjobs/create\",\n \"deployments/create\", \"deployments/patch\", \"deployments/update\",\n \"statefulsets/create\", \"statefulsets/patch\", \"statefulsets/update\"\n]);\nlet BaselineCallers =\n AzureDiagnostics\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | where Category =~ \"kube-audit\"\n | where OperationName has_any (SensitiveWriteOps)\n | where isnotempty(Caller_s)\n | summarize by CallerNorm = tolower(Caller_s);\nAzureDiagnostics\n| where TimeGenerated between (StartTime .. EndTime)\n| where Category =~ \"kube-audit\"\n| where OperationName has_any (SensitiveWriteOps)\n| where isnotempty(Caller_s)\n| extend CallerNorm = tolower(Caller_s)\n| join kind=leftanti BaselineCallers on CallerNorm\n| extend Severity = case(\n OperationName has_any (\"clusterrolebindings\", \"rolebindings\"),\n \"Critical β€” RBAC privilege escalation\",\n OperationName has_any (\"daemonsets\", \"cronjobs\"),\n \"High β€” workload persistence (every node / scheduled)\",\n \"High β€” first-seen control plane write\")\n| extend SeverityLevel = tostring(split(Severity, \" \")[0])\n| extend ResourcePortalUrl = strcat(\"https://portal.azure.com/#@/resource\", ResourceId, \"/overview\")\n| project TimeGenerated, SeverityLevel, Severity, Caller = CallerNorm, OperationName, Resource, ResourceId,ResourceGroup, ResourcePortalUrl, Category\n| where isempty('{UserFilter}') or Caller contains '{UserFilter}'\n| sort by Severity asc, TimeGenerated desc\n| limit 25", "size": 0, "title": "Kubernetes First-Seen Control-Plane Writer", "noDataMessage": "βœ… No first-seen K8s control-plane writers in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SeverityLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Critical", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "High", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "ResourcePortalUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— View Resource" } }, { "columnMatch": "TimeGenerated", "formatter": 6 } ], "labelSettings": [ { "columnId": "SeverityLevel", "label": "Severity" }, { "columnId": "Severity", "label": "Severity Detail" }, { "columnId": "Caller", "label": "Caller (Principal)" }, { "columnId": "OperationName", "label": "Operation" }, { "columnId": "Resource", "label": "Resource" }, { "columnId": "ResourceId", "label": "Resource ID" }, { "columnId": "ResourcePortalUrl", "label": "Portal" }, { "columnId": "Category", "label": "Log Category" }, { "columnId": "TimeGenerated", "label": "Write Time" } ] } }, "conditionalVisibilities": [ { "parameterName": "IPFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ia-r3-k8s-controlplane", "id": "44eaf230-716a-40af-8a42-2a68ae516797" } ] }, "conditionalVisibility": { "parameterName": "isInitialAccessVisible", "comparison": "isEqualTo", "value": "true" }, "name": "section-2-InitialAccess", "id": "257eadeb-29b1-4357-b57a-474a4c4742f3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## 🟑 Persistence\nMFA methods registered on risky accounts, secrets added to dormant service principals, federation/identity-provider changes, app-credential changes preceding SP sign-in bursts, and Kubernetes daemonset/cronjob deployment by non-automation identities.\n\n**MITRE:** T1098.005 Β· T1098.001 Β· T1556.007 Β· T1136.003 Β· T1053.003 \n**Key tables:** AuditLogs Β· SigninLogs Β· AADServicePrincipalSignInLogs Β· _Im_Authentication Β· _Im_AuditEvent Β· AzureDiagnostics" }, "conditionalVisibilities": [ { "parameterName": "IPFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "name": "section-4-text", "id": "15666803-e74c-4c25-91b3-ccdecbc753e8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let riskLevels = dynamic([\"medium\", \"high\"]);\n let MFAEvents = AuditLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationName in (\n \"User registered security info\",\n \"Admin registered security info\",\n \"User updated security info\",\n \"Admin updated security info\",\n \"User changed default security info\",\n \"User deleted security info\",\n \"Admin deleted security info\")\n | where Result =~ \"success\"\n | extend TargetUserUPN = tostring(TargetResources[0].userPrincipalName)\n | extend TargetUserId = tostring(TargetResources[0].id)\n | extend ActorUPN = tostring(InitiatedBy.user.userPrincipalName)\n | extend ActorId = tostring(InitiatedBy.user.id)\n | extend ActorIP = tostring(InitiatedBy.user.ipAddress)\n | where isnotempty(TargetUserId)\n | mv-expand Detail = AdditionalDetails\n | extend DetailKey = tostring(Detail.key)\n | extend DetailValue = tostring(Detail.value)\n | summarize\n MFATime = min(TimeGenerated),\n ActorUPN = any(ActorUPN),\n ActorId = any(ActorId),\n ActorIP = any(ActorIP),\n AuthMethod = anyif(DetailValue, DetailKey == \"AuthenticationMethod\")\n by Id, OperationName, TargetUserUPN, TargetUserId;\n let RiskyUsers = SigninLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where RiskLevelAggregated in (riskLevels)\n | summarize LastRiskySignIn = max(TimeGenerated), MaxRiskRank = max(case(RiskLevelAggregated == \"high\", 3, RiskLevelAggregated == \"medium\", 2, RiskLevelAggregated == \"low\", 1, 0)) by UserId\n | extend MaxRiskLevel = case(MaxRiskRank == 3, \"high\", MaxRiskRank == 2, \"medium\", MaxRiskRank == 1, \"low\", \"none\");\n MFAEvents\n | join kind=inner RiskyUsers on $left.TargetUserId == $right.UserId\n | where LastRiskySignIn <= MFATime\n | extend AdminPerformedChange = iff(ActorUPN != TargetUserUPN and isnotempty(ActorUPN), true, false)\n | where isempty('{UserFilter}') or TargetUserUPN contains '{UserFilter}'\n | summarize\n TotalEvents = count(),\n HighRiskCount = countif(MaxRiskLevel == \"high\"),\n MediumRiskCount = countif(MaxRiskLevel == \"medium\"),\n AdminChanges = countif(AdminPerformedChange == true),\n AffectedUsers = dcount(TargetUserUPN)\n | project\n Title = \"MFA on Risky Accounts\",\n TotalEvents,\n HighRiskCount,\n MediumRiskCount,\n AdminChanges,\n AffectedUsers", "size": 0, "title": "MFA Method Added on Risky Account", "noDataMessage": "βœ… No MFA changes on risky accounts in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Title", "formatter": 1 }, "leftContent": { "columnMatch": "TotalEvents", "formatter": 12, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 0 } } }, "secondaryContent": { "columnMatch": "HighRiskCount", "formatter": 1, "formatOptions": { "compositeBarSettings": { "labelText": "High Risk: [\"HighRiskCount\"]", "columnSettings": [] } } }, "showBorder": true, "size": "auto" } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "IPFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ps-p1-mfa-risky-account-summary", "id": "a6838e0d-720f-4742-9df3-162dd6a24af1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let riskLevels = dynamic([\"medium\", \"high\"]);\n let MFAEvents = AuditLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationName in (\n \"User registered security info\",\n \"Admin registered security info\",\n \"User updated security info\",\n \"Admin updated security info\",\n \"User changed default security info\",\n \"User deleted security info\",\n \"Admin deleted security info\")\n | where Result =~ \"success\"\n | extend TargetUserUPN = tostring(TargetResources[0].userPrincipalName)\n | extend TargetUserId = tostring(TargetResources[0].id)\n | extend ActorUPN = tostring(InitiatedBy.user.userPrincipalName)\n | extend ActorId = tostring(InitiatedBy.user.id)\n | extend ActorIP = tostring(InitiatedBy.user.ipAddress)\n | where isnotempty(TargetUserId)\n | mv-expand Detail = AdditionalDetails\n | extend DetailKey = tostring(Detail.key)\n | extend DetailValue = tostring(Detail.value)\n | summarize\n MFATime = min(TimeGenerated),\n ActorUPN = any(ActorUPN),\n ActorId = any(ActorId),\n ActorIP = any(ActorIP),\n AuthMethod = anyif(DetailValue, DetailKey == \"AuthenticationMethod\")\n by Id, OperationName, TargetUserUPN, TargetUserId;\n let RiskyUsers = SigninLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where RiskLevelAggregated in (riskLevels)\n | summarize\n LastRiskySignIn = max(TimeGenerated),\n MaxRiskRank = max(case(RiskLevelAggregated == \"high\", 3, RiskLevelAggregated == \"medium\", 2, RiskLevelAggregated == \"low\", 1, 0)),\n RiskySignInIP = any(IPAddress),\n RiskyLocation = any(Location)\n by UserId\n | extend MaxRiskLevel = case(MaxRiskRank == 3, \"high\", MaxRiskRank == 2, \"medium\", MaxRiskRank == 1, \"low\", \"none\");\n MFAEvents\n | join kind=inner RiskyUsers on $left.TargetUserId == $right.UserId\n | where LastRiskySignIn <= MFATime\n | extend AdminPerformedChange = iff(ActorUPN != TargetUserUPN and isnotempty(ActorUPN), \"Admin\", \"Self\")\n | extend EntraProfileUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/\", TargetUserId)\n | project\n MaxRiskLevel,\n AdminPerformedChange,\n TargetUserUPN,\n EntraProfileUrl,\n AuthMethod,\n OperationName,\n ActorUPN,\n ActorIP,\n RiskySignInIP,\n RiskyLocation,\n LastRiskySignIn,\n MFATime\n | where isempty('{UserFilter}') or TargetUserUPN contains '{UserFilter}'\n | where isempty('{IPFilter}') or ActorIP contains '{IPFilter}' or RiskySignInIP contains '{IPFilter}'\n | sort by MFATime desc\n | take 25", "size": 0, "title": "MFA Method Added on Risky Account - Detailed", "noDataMessage": "βœ… No MFA changes on risky accounts in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "formatters": [ { "columnMatch": "MaxRiskLevel", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "redBright", "text": "{0}" }, { "operator": "==", "thresholdValue": "medium", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}" } ] } }, { "columnMatch": "AdminPerformedChange", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Admin", "representation": "warning", "text": "Admin" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "Self" } ] } }, { "columnMatch": "EntraProfileUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— View Profile" } }, { "columnMatch": "MFATime", "formatter": 6 }, { "columnMatch": "LastRiskySignIn", "formatter": 6 } ], "labelSettings": [ { "columnId": "MaxRiskLevel", "label": "Risk Level" }, { "columnId": "AdminPerformedChange", "label": "Changed By" }, { "columnId": "TargetUserUPN", "label": "Target User" }, { "columnId": "EntraProfileUrl", "label": "Entra Profile" }, { "columnId": "AuthMethod", "label": "MFA Method" }, { "columnId": "ActorUPN", "label": "Actor" }, { "columnId": "ActorIP", "label": "Actor IP" }, { "columnId": "RiskySignInIP", "label": "Risky Sign-in IP" }, { "columnId": "RiskyLocation", "label": "Location" }, { "columnId": "LastRiskySignIn", "label": "Last Risky Sign-in" }, { "columnId": "MFATime", "label": "MFA Change Time" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ps-p1-mfa-risky-account-detail", "id": "bd80b22a-716d-4406-8348-7b21b308a6e9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let dormancyWindow = 14d;\n let CredentialAdditions = AuditLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationName == \"Add service principal credentials\"\n | where Result =~ \"success\"\n | extend TargetSPId = tostring(TargetResources[0].id)\n | extend TargetSPName = tostring(TargetResources[0].displayName)\n | extend ActorUPN = tostring(InitiatedBy.user.userPrincipalName)\n | extend ActorUserId = tostring(InitiatedBy.user.id)\n | extend ActorAppName = tostring(InitiatedBy.app.displayName)\n | extend ActorAppId = tostring(InitiatedBy.app.appId)\n | extend ActorIPAddress = tostring(InitiatedBy.user.ipAddress)\n | extend Actor = iif(isnotempty(ActorUPN), ActorUPN, ActorAppName)\n | extend ActorType = case(isnotempty(ActorUPN), \"User\", isnotempty(ActorAppName), \"App\", \"Unknown\")\n | where isnotempty(TargetSPId)\n | project CredentialAddTime = TimeGenerated, TargetSPId, TargetSPName,\n ActorUPN, ActorUserId, ActorAppName, ActorAppId, ActorIPAddress, Actor, ActorType;\n let TargetSPIds = CredentialAdditions | distinct TargetSPId;\n let SPSignIns = AADServicePrincipalSignInLogs\n | where TimeGenerated between ((StartTime - dormancyWindow) .. EndTime)\n | where ResultType == \"0\"\n | where ServicePrincipalId in (TargetSPIds)\n | project SignInTime = TimeGenerated, ServicePrincipalId, AppId;\n CredentialAdditions\n | join kind=leftouter (SPSignIns) on $left.TargetSPId == $right.ServicePrincipalId\n | summarize\n LastSignInBeforeAdd = maxif(SignInTime, SignInTime < CredentialAddTime),\n FirstSignInAfterAdd = minif(SignInTime, SignInTime >= CredentialAddTime),\n TargetSPName = take_any(TargetSPName),\n ActorUPN = take_any(ActorUPN),\n ActorUserId = take_any(ActorUserId),\n ActorAppName = take_any(ActorAppName),\n ActorAppId = take_any(ActorAppId),\n ActorIPAddress = take_any(ActorIPAddress),\n Actor = take_any(Actor),\n ActorType = take_any(ActorType),\n SPAppId = take_anyif(AppId, isnotempty(AppId))\n by TargetSPId, CredentialAddTime\n | where isnull(LastSignInBeforeAdd)\n or LastSignInBeforeAdd < (CredentialAddTime - dormancyWindow) \n | where isnotnull(FirstSignInAfterAdd)\n | extend DormancyStatus = iif(isnull(LastSignInBeforeAdd),\n strcat(\"No sign-in in prior \", tostring(toint(dormancyWindow / 1d)), \" days\"),\n strcat(tostring(datetime_diff('day', CredentialAddTime, LastSignInBeforeAdd)), \" days dormant\"))\n | extend MinutesToActivation = datetime_diff('minute', FirstSignInAfterAdd, CredentialAddTime)\n | extend AnonymousActor = isempty(Actor)\n | extend EntraSPUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/\", TargetSPId, \"/appId/\", SPAppId)\n | extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", ActorIPAddress, \"/overview\")\n | project\n MinutesToActivation,\n AnonymousActor,\n ActorType,\n Actor,\n TargetSPName,\n EntraSPUrl,\n DormancyStatus,\n ActorIPAddress,\n XDRIPUrl,\n CredentialAddTime,\n FirstSignInAfterAdd\n | where isempty('{UserFilter}') or Actor contains '{UserFilter}'\n | where isempty('{IPFilter}') or ActorIPAddress contains '{IPFilter}'\n | order by MinutesToActivation asc, CredentialAddTime desc\n | take 25", "size": 0, "title": "Secret Added to Dormant Service Principal", "noDataMessage": "βœ… No secrets added to dormant service principals in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "MinutesToActivation", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<", "thresholdValue": "60", "representation": "redBright", "text": "🚨 {0}{1} min" }, { "operator": "<", "thresholdValue": "1440", "representation": "orange", "text": "⚠️ {0}{1} min" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1} min" } ] } }, { "columnMatch": "AnonymousActor", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "warning", "text": "⚠️ Unknown" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "βœ… Known" } ] } }, { "columnMatch": "ActorType", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Unknown", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "App", "representation": "blue", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "EntraSPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— View SP" } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate" } }, { "columnMatch": "CredentialAddTime", "formatter": 6 }, { "columnMatch": "FirstSignInAfterAdd", "formatter": 6 } ], "labelSettings": [ { "columnId": "MinutesToActivation", "label": "Time to Activate" }, { "columnId": "AnonymousActor", "label": "Actor Known" }, { "columnId": "ActorType", "label": "Actor Type" }, { "columnId": "Actor", "label": "Actor" }, { "columnId": "TargetSPName", "label": "Service Principal" }, { "columnId": "EntraSPUrl", "label": "Entra" }, { "columnId": "DormancyStatus", "label": "Dormancy" }, { "columnId": "ActorIPAddress", "label": "Actor IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "CredentialAddTime", "label": "Secret Added" }, { "columnId": "FirstSignInAfterAdd", "label": "First Sign-in After" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ps-p2-secret-dormant-sp", "id": "f5c8dc6a-9d3b-4e91-a74f-55fcfa9a301c" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let FederationEvents = AuditLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationName in (\"Set domain authentication\",\"Set federation settings on domain\")\n | where Result =~ \"success\"\n | extend ActorUPN=tostring(InitiatedBy.user.userPrincipalName),\n ActorIPAddress=tostring(InitiatedBy.user.ipAddress),\n ActorId=tostring(InitiatedBy.user.id),\n TargetDomain=tostring(TargetResources[0].displayName),\n TargetDomainId=tostring(TargetResources[0].id)\n | mv-expand Detail = AdditionalDetails\n | extend DetailKey=tostring(Detail.key), DetailValue=tostring(Detail.value)\n | summarize FederationTime=min(TimeGenerated),\n OperationNames=make_set(OperationName),\n ActorUPN=any(ActorUPN),\n ActorIPAddress=any(ActorIPAddress),\n ActorId=any(ActorId),\n UserAgent=anyif(DetailValue, DetailKey == \"User-Agent\"),\n EventCount=dcount(Id)\n by TargetDomain, TargetDomainId;\n let FederationActorIds = FederationEvents | where isnotempty(ActorId) | distinct ActorId;\n FederationEvents\n | join kind=leftouter (\n SigninLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where UserId in (FederationActorIds)\n | where RiskLevelAggregated in (\"medium\",\"high\")\n | summarize MaxRiskLevel=max(RiskLevelAggregated),\n LastRiskySignIn=max(TimeGenerated),\n RiskySignInIP=any(IPAddress)\n by UserId\n ) on $left.ActorId == $right.UserId\n | extend IsPowerShell=UserAgent has_any (\"PowerShell\",\"python\",\"curl\",\"AADInternals\")\n | extend IsAnonymousActor=isempty(ActorUPN)\n | extend SuspicionScore=toint(IsPowerShell)+toint(IsAnonymousActor)+toint(MaxRiskLevel in (\"medium\",\"high\")), ActorRisk= MaxRiskLevel\n | extend\n EntraProfileUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/\", ActorId),\n XDRUserUrl = strcat(\"https://security.microsoft.com/users/\", ActorId, \"/overview\"),\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", ActorIPAddress, \"/overview\")\n | where isempty('{UserFilter}') or ActorUPN contains '{UserFilter}'\n | where isempty('{IPFilter}') or ActorIPAddress contains '{IPFilter}'\n | project SuspicionScore, FederationTime, TargetDomain,\n ActorUPN, ActorIPAddress,\n XDRIPUrl, ActorRisk, LastRiskySignIn, RiskySignInIP,\n IsPowerShell, IsAnonymousActor, UserAgent, OperationNames,\n EventCount\n | order by SuspicionScore desc, FederationTime desc\n | limit 25", "size": 0, "title": "Federated Identity Provider Added to Tenant", "noDataMessage": "βœ… No federation or domain authentication changes in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SuspicionScore", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "3", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": ">=", "thresholdValue": "1", "representation": "yellow", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "IsAnonymousActor", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "warning", "text": "⚠️ Anonymous" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "βœ… Known" } ] } }, { "columnMatch": "IsPowerShell", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "warning", "text": "⚠️ Scripted" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "βœ… No" } ] } }, { "columnMatch": "ActorRisk", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "high", "representation": "redBright", "text": "πŸ”΄ {0}{1}" }, { "operator": "==", "thresholdValue": "medium", "representation": "orange", "text": "🟠 {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "FederationTime", "formatter": 6 }, { "columnMatch": "LastRiskySignIn", "formatter": 6 } ], "labelSettings": [ { "columnId": "SuspicionScore", "label": "Suspicion Score" }, { "columnId": "FederationTime", "label": "Federation Changed" }, { "columnId": "TargetTenant", "label": "Target Domain" }, { "columnId": "ActorUPN", "label": "Actor" }, { "columnId": "ActorIPAddress", "label": "Actor IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "ActorRisk", "label": "Actor Risk" }, { "columnId": "LastRiskySignIn", "label": "Last Risky Sign-in" }, { "columnId": "RiskySignInIP", "label": "Risky IP" }, { "columnId": "IsPowerShell", "label": "Scripted Tool" }, { "columnId": "IsAnonymousActor", "label": "Anonymous Actor" }, { "columnId": "UserAgent", "label": "User Agent" }, { "columnId": "OperationNames", "label": "Operations" }, { "columnId": "EventCount", "label": "Events" }, { "columnId": "FederationPortalUrl", "label": "Remediate" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ps-p3-federation-provider", "id": "9bd52054-224d-465c-9c90-701d16d51782" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let CredChanges =\n _Im_AuditEvent(starttime=StartTime, endtime=EndTime)\n | extend OperationText = tolower(tostring(coalesce(Operation, EventType, EventMessage))),\n TargetId = tolower(tostring(coalesce(ObjectId, ActorUserId))),\n TargetName = tostring(Object),\n Initiator = tostring(ActorUsername),\n InitiatorIp = tostring(SrcIpAddr)\n | where OperationText has_any (\"credential\", \"certificate\", \"secret\", \"password\", \"service principal\", \"application\")\n | where isnotempty(TargetId)\n | project ChangeTime=TimeGenerated, OperationText, TargetId, TargetName, Initiator, InitiatorIp;\n let SPBurst =\n _Im_Authentication(starttime=StartTime, endtime=(EndTime + 1d))\n | where EventResult == \"Success\"\n | where ActorUserType has \"Service Principal\"\n | extend PrincipalId = tolower(tostring(ActorUserId)),\n PrincipalName = tostring(ActorUsername),\n SrcIp = tostring(SrcIpAddr),\n UserAgent = tostring(HttpUserAgent)\n | where isnotempty(PrincipalId)\n | summarize FirstSignin=min(TimeGenerated), LastSignin=max(TimeGenerated), SigninCount=count(), DistinctIPs=dcount(SrcIp),\n SrcIps=make_set(SrcIp, 20), UserAgents=make_set(UserAgent, 10)\n by PrincipalId, PrincipalName;\n CredChanges\n | join kind=inner SPBurst on $left.TargetId == $right.PrincipalId\n | where FirstSignin between (ChangeTime .. (ChangeTime + 24h))\n | where SigninCount >= 3\n | project TimeGenerated=ChangeTime, SigninCount, DistinctIPs, TargetName, OperationText, Initiator, InitiatorIp,\n PrincipalName, FirstSignin, LastSignin, TargetId, SrcIps, UserAgents\n | extend EntraAppUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/\", TargetId, \"/appId/\"),\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", InitiatorIp, \"/overview\")\n | where isempty('{UserFilter}') or Initiator contains '{UserFilter}' or PrincipalName contains '{UserFilter}'\n | where isempty('{IPFilter}') or InitiatorIp contains '{IPFilter}' or tostring(SrcIps) contains '{IPFilter}'\n | order by SigninCount desc, TimeGenerated desc\n | take 25", "size": 0, "title": "App credential change followed by SP sign-in burst", "noDataMessage": "βœ… No app credential changes correlated with service principal sign-in bursts in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SigninCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "20", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "10", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "DistinctIPs", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "EntraAppUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— App Reg" } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstSignin", "formatter": 6 }, { "columnMatch": "LastSignin", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Credential Changed" }, { "columnId": "SigninCount", "label": "Sign-in Count" }, { "columnId": "DistinctIPs", "label": "Distinct IPs" }, { "columnId": "TargetName", "label": "Target App/SP" }, { "columnId": "OperationText", "label": "Operation" }, { "columnId": "Initiator", "label": "Initiator" }, { "columnId": "InitiatorIp", "label": "Initiator IP" }, { "columnId": "PrincipalName", "label": "SP (signed in)" }, { "columnId": "FirstSignin", "label": "Burst Start" }, { "columnId": "LastSignin", "label": "Burst End" }, { "columnId": "TargetId", "label": "Target App/SP Id" }, { "columnId": "SrcIps", "label": "Source IPs" }, { "columnId": "UserAgents", "label": "User Agents" }, { "columnId": "EntraAppUrl", "label": "Entra" }, { "columnId": "XDRIPUrl", "label": "XDR" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ps-p4-app-cred-sp-burst", "id": "c26b0e56-5f4e-4e6a-852a-76d4f65fe8c0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet AllowedAutomationPrincipals = dynamic([\"ci-pipeline-sp\", \"aks-maintenance-mi\", \"github-actions-mi\", \"ado-release-sp\"]);\nAzureDiagnostics\n| where TimeGenerated between (StartTime .. EndTime)\n| where Category has \"kube-audit\"\n| where OperationName has_any (\"daemonsets/create\", \"cronjobs/create\")\n| where isnotempty(Caller_s)\n| extend CallerNorm = tolower(Caller_s)\n| where CallerNorm !in (AllowedAutomationPrincipals)\n| summarize\n EventCount = count(),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n Operations = make_set(OperationName, 10),\n Resources = make_set(Resource, 20)\n by Caller = CallerNorm, ResourceId\n| extend TimeGenerated = FirstSeen, Operations = tostring(Operations),\n Resources = tostring(Resources)\n| extend ResourcePortalUrl = strcat(\"https://portal.azure.com/#@/resource\", ResourceId, \"/overview\")\n| project TimeGenerated, Caller, EventCount, Operations, ResourcePortalUrl, FirstSeen, LastSeen, Resources\n| where isempty('{UserFilter}') or Caller contains '{UserFilter}'\n| order by EventCount desc, LastSeen desc\n| limit 25", "size": 0, "title": "Kubernetes daemonset or cronjob by non-automation identity", "noDataMessage": "βœ… No daemonset/cronjob creation by non-automation identities in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "EventCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "ResourcePortalUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— Open Cluster" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstSeen", "formatter": 6 }, { "columnMatch": "LastSeen", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Activity Time" }, { "columnId": "Caller", "label": "Identity" }, { "columnId": "EventCount", "label": "Event Count" }, { "columnId": "Operations", "label": "Operations" }, { "columnId": "ResourcePortalUrl", "label": "Cluster" }, { "columnId": "FirstSeen", "label": "First Seen" }, { "columnId": "LastSeen", "label": "Last Seen" }, { "columnId": "Resources", "label": "K8s Objects" } ] } }, "conditionalVisibilities": [ { "parameterName": "IPFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ps-p5-k8s-daemonset-cronjob", "id": "d1bf2018-2522-4105-bc9a-ae3030d48273" } ] }, "conditionalVisibility": { "parameterName": "isPersistenceVisible", "comparison": "isEqualTo", "value": "true" }, "name": "section-3-Persistence", "id": "773d5860-4281-4bc6-a876-6795ebbffb88" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## ⚫ Defense Evasion\nMulti-service network exposure preceding key/data access, novel SPN sign-ins into Azure RBAC writes, Azure network-config tampering by compromised identities, and pod-token tooling preceding cloud RBAC writes.\n\n**MITRE:** T1562 Β· T1578 Β· T1550.001 Β· T1098.003 \n**Key tables:** AzureActivity Β· AADServicePrincipalSignInLogs Β· BehaviorAnalytics Β· DeviceInfo" }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "name": "section-7-text", "id": "694407df-d1e0-40ea-b1ec-d244ae796399" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet SequenceWindow = 2h;\n // Successful activity status values for AzureActivity write operations.\n let SuccessActivityStatusValues = dynamic([\"succeeded\", \"success\"]);\n // Exposure write operation families for Key Vault, Storage, and Azure database services.\n let ExposureOpPrefixes = dynamic([\n \"microsoft.keyvault/vaults/write\",\n \"microsoft.keyvault/vaults/accesspolicies/write\",\n \"microsoft.storage/storageaccounts/write\",\n \"microsoft.sql/servers/firewallrules/write\",\n \"microsoft.dbforpostgresql/\",\n \"microsoft.dbformysql/\"\n ]);\n // Parent operations that can carry network exposure changes in operation properties.\n let ExposureParentWriteOps = dynamic([\n \"microsoft.keyvault/vaults/write\",\n \"microsoft.storage/storageaccounts/write\",\n \"microsoft.sql/servers/write\",\n \"microsoft.dbforpostgresql/flexibleservers/write\",\n \"microsoft.dbformysql/flexibleservers/write\"\n ]);\n // Action fragments that indicate network posture or access control changes.\n let ExposureActionValues = dynamic([\n \"networkacls/write\",\n \"firewallrules/write\",\n \"virtualnetworkrules/write\",\n \"accesspolicies/write\",\n \"publicnetworkaccess/write\"\n ]);\n // Property tokens that indicate firewall, ACL, or public access weakening.\n let NetworkConfigSignals = dynamic([\n \"publicnetworkaccess\",\n \"networkacls\",\n \"defaultaction\",\n \"iprules\",\n \"virtualnetworkrules\",\n \"bypass\",\n \"firewallrules\"\n ]);\n // Service-specific access patterns used to detect post-exposure key or data access.\n let KeyVaultAccessActions = dynamic([\"/read\", \"/list\", \"secrets\", \"keys\"]);\n let StorageAccessActions = dynamic([\"listkeys/action\", \"/list\", \"/read\"]);\n let SqlAccessActions = dynamic([\"/read\", \"/list\"]);\n let PostgresAccessActions = dynamic([\"/read\", \"/list\", \"listkeys\"]);\n let MysqlAccessActions = dynamic([\"/read\", \"/list\", \"listkeys\"]);\n // Stage 1: Detect exposure-changing writes.\n let ExposureWrites =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(Caller), CallerIp = tostring(CallerIpAddress), Op = tolower(OperationNameValue),\n ActivityStatusNorm = tolower(tostring(ActivityStatusValue)), Props = tolower(tostring(Properties_d))\n | where ActivityStatusNorm in (SuccessActivityStatusValues)\n | where Op has_any (ExposureOpPrefixes)\n | where (Op has_any (ExposureActionValues))\n or (Op in~ (ExposureParentWriteOps) and Props has_any (NetworkConfigSignals))\n | extend ServiceFamily = case(\n Op startswith \"microsoft.keyvault/vaults/\", \"KeyVault\",\n Op startswith \"microsoft.storage/storageaccounts/\", \"Storage\",\n Op startswith \"microsoft.sql/servers/\", \"AzureSQL\",\n Op startswith \"microsoft.dbforpostgresql/\", \"PostgreSQL\",\n Op startswith \"microsoft.dbformysql/\", \"MySQL\",\n \"Other\")\n | summarize FirstExposure=min(TimeGenerated), LastExposure=max(TimeGenerated), ExposureCount=count(),\n ExposureOps=make_set(OperationNameValue, 30), ExposureResources=make_set(ResourceId, 30),\n ServiceSet=make_set(ServiceFamily, 10)\n by CallerNorm, CallerIp, SubscriptionId;\n // Stage 2: Detect key, secret, and data access operations after exposure tampering.\n let AccessOps =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(Caller), CallerIp = tostring(CallerIpAddress), Op = tolower(OperationNameValue),\n ActivityStatusNorm = tolower(tostring(ActivityStatusValue))\n | where ActivityStatusNorm in (SuccessActivityStatusValues)\n | where (\n Op has \"microsoft.keyvault/vaults/\" and Op has_any (KeyVaultAccessActions)\n ) or (\n Op has \"microsoft.storage/storageaccounts/\" and Op has_any (StorageAccessActions)\n ) or (\n Op has \"microsoft.sql/servers/databases/\" and Op has_any (SqlAccessActions)\n ) or (\n Op has \"microsoft.dbforpostgresql/\" and Op has_any (PostgresAccessActions)\n ) or (\n Op has \"microsoft.dbformysql/\" and Op has_any (MysqlAccessActions)\n )\n | summarize FirstAccess=min(TimeGenerated), LastAccess=max(TimeGenerated), AccessCount=count(),\n AccessOps=make_set(OperationNameValue, 40), AccessResources=make_set(ResourceId, 40)\n by CallerNorm, CallerIp, SubscriptionId;\n // Stage 3: Correlate multi-service exposure writes with follow-on access in a tight sequence window.\n ExposureWrites\n | extend DistinctServiceCount = array_length(ServiceSet)\n | where DistinctServiceCount >= 2\n | join kind=inner AccessOps on CallerNorm, SubscriptionId, CallerIp\n | where FirstAccess between (FirstExposure .. (LastExposure + SequenceWindow))\n | extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", CallerIp, \"/overview\")\n | project TimeGenerated=FirstExposure, DistinctServiceCount, ServiceSet, ExposureCount, AccessCount,\n Caller=CallerNorm, CallerIp, XDRIPUrl, SubscriptionId,\n FirstExposure, LastExposure, FirstAccess, LastAccess,\n ExposureOps, AccessOps, ExposureResources, AccessResources\n | where isempty('{UserFilter}') or Caller contains '{UserFilter}'\n | where isempty('{IPFilter}') or CallerIp contains '{IPFilter}'\n | order by DistinctServiceCount desc, ExposureCount desc, AccessCount desc, FirstAccess desc\n | limit 25", "size": 0, "title": "Multi-service network exposure followed by key and data access", "noDataMessage": "βœ… No multi-service network exposure followed by key/data access in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DistinctServiceCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "3", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "ExposureCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "AccessCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstExposure", "formatter": 6 }, { "columnMatch": "LastExposure", "formatter": 6 }, { "columnMatch": "FirstAccess", "formatter": 6 }, { "columnMatch": "LastAccess", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Exposure Started" }, { "columnId": "DistinctServiceCount", "label": "Distinct Services" }, { "columnId": "ServiceSet", "label": "Services Weakened" }, { "columnId": "ExposureCount", "label": "Exposure Writes" }, { "columnId": "AccessCount", "label": "Key/Data Access Ops" }, { "columnId": "Caller", "label": "Identity" }, { "columnId": "CallerIp", "label": "Caller IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "SubscriptionId", "label": "Subscription" }, { "columnId": "FirstExposure", "label": "First Exposure" }, { "columnId": "LastExposure", "label": "Last Exposure" }, { "columnId": "FirstAccess", "label": "First Access" }, { "columnId": "LastAccess", "label": "Last Access" }, { "columnId": "ExposureOps", "label": "Exposure Operations" }, { "columnId": "AccessOps", "label": "Access Operations" }, { "columnId": "ExposureResources", "label": "Exposure Resources" }, { "columnId": "AccessResources", "label": "Access Resources" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "de-de4-multiservice-exposure-access", "id": "1fb16b49-1512-460c-b0e8-09706264e88f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineWindow = 14d;\n let RbacWindow = 60m;\n // Baseline successful SPN sign-in tuples for rarity test\n let SpnBaseline =\n AADServicePrincipalSignInLogs\n | where TimeGenerated between ((StartTime - BaselineWindow) .. StartTime)\n | where ResultType =~ 'Success' or ResultType == '0'\n | extend SpId = tolower(tostring(ServicePrincipalId)),\n AppIdNorm = tolower(tostring(AppId)),\n IpNorm = tostring(IPAddress),\n UaNorm = tostring(UserAgent),\n CredNorm = tolower(tostring(ClientCredentialType))\n | where isnotempty(SpId) and isnotempty(IpNorm)\n | summarize by SpId, AppIdNorm, IpNorm, UaNorm, CredNorm;\n // Current successful SPN sign-ins in hunt interval\n let SpnCurrent =\n AADServicePrincipalSignInLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where ResultType =~ 'Success' or ResultType == '0'\n | extend SpId = tolower(tostring(ServicePrincipalId)),\n AppIdNorm = tolower(tostring(AppId)),\n IpNorm = tostring(IPAddress),\n UaNorm = tostring(UserAgent),\n CredNorm = tolower(tostring(ClientCredentialType))\n | where isnotempty(SpId) and isnotempty(IpNorm)\n | project SigninTime = TimeGenerated,\n SpId,\n AppIdNorm,\n SpnName = tostring(ServicePrincipalName),\n Identity,\n IpNorm,\n UaNorm,\n CredNorm,\n ResourceDisplayName,\n CorrelationId;\n // Keep only first-seen tuples for high-fidelity hunting.\n let SpnNovel =\n SpnCurrent\n | join kind=leftanti SpnBaseline on SpId, AppIdNorm, IpNorm, UaNorm, CredNorm;\n // Collect RBAC-impacting control-plane write operations\n let RbacWrites =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where ActivityStatusValue =~ 'Succeeded' or ActivitySubstatusValue has 'OK'\n | extend Op = tolower(tostring(OperationNameValue)),\n CallerNorm = tolower(tostring(Caller))\n | where Op has_any (\n 'microsoft.authorization/roleassignments/write',\n 'microsoft.authorization/roledefinitions/write',\n 'microsoft.authorization/roleassignments/delete'\n )\n | project WriteTime = TimeGenerated,\n CallerNorm,\n CallerIpAddress,\n OperationNameValue,\n ResourceId,\n ResourceGroup,\n SubscriptionId,\n CorrelationId,\n Authorization_d;\n // Correlate novel SPN sign-in to RBAC writes via ServicePrincipalId/AppId\n SpnNovel\n | extend JoinKeys = pack_array(SpId, AppIdNorm)\n | mv-expand JoinKey = JoinKeys\n | extend JoinKey = tostring(JoinKey)\n | join kind=inner (\n RbacWrites\n | project WriteTime, CallerNorm, CallerIpAddress, OperationNameValue, ResourceId, ResourceGroup, SubscriptionId, CorrelationId, Authorization_d\n ) on $left.JoinKey == $right.CallerNorm\n // Require near-term temporal chain for stronger suspicion.\n | where WriteTime between (SigninTime .. (SigninTime + RbacWindow))\n | summarize FirstSignin=min(SigninTime),\n FirstRbacWrite=min(WriteTime),\n LastRbacWrite=max(WriteTime),\n RbacWriteCount=count(),\n Operations=make_set(OperationNameValue, 10),\n ResourcesTouched=make_set(ResourceId, 20),\n ResourceGroups=make_set(ResourceGroup, 20),\n Subscriptions=make_set(SubscriptionId, 10),\n FirstSigninIp=any(IpNorm),\n SigninIps=make_set(IpNorm, 5),\n WriteIps=make_set(CallerIpAddress, 5)\n by SpId, AppIdNorm, SpnName, Identity, UaNorm, CredNorm\n | extend TimeGenerated = FirstSignin,\n MinutesToRbac = datetime_diff('minute', FirstRbacWrite, FirstSignin),\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", FirstSigninIp, \"/overview\"),\n EntraAppUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/\", SpId, \"/appId/\", AppIdNorm)\n | project TimeGenerated, RbacWriteCount, MinutesToRbac, Operations,\n SpnName, Identity, AppIdNorm, EntraAppUrl, CredNorm, UaNorm,\n FirstSigninIp, XDRIPUrl, SigninIps, WriteIps,\n FirstSignin, FirstRbacWrite, LastRbacWrite,\n ResourcesTouched, ResourceGroups, Subscriptions, SpId\n | where isempty('{UserFilter}') or SpnName contains '{UserFilter}' or Identity contains '{UserFilter}'\n | where isempty('{IPFilter}') or FirstSigninIp contains '{IPFilter}'\n | order by RbacWriteCount desc, FirstRbacWrite desc\n | limit 25", "size": 0, "title": "Novel SPN sign-in followed by Azure RBAC write", "noDataMessage": "βœ… No novel service principal sign-ins followed by Azure RBAC writes in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "RbacWriteCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "MinutesToRbac", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1} min" }, { "operator": "<", "thresholdValue": "30", "representation": "orange", "text": "⚠️ {0}{1} min" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1} min" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "EntraAppUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— App Reg" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstSignin", "formatter": 6 }, { "columnMatch": "FirstRbacWrite", "formatter": 6 }, { "columnMatch": "LastRbacWrite", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Sign-in Time" }, { "columnId": "RbacWriteCount", "label": "RBAC Writes" }, { "columnId": "MinutesToRbac", "label": "Mins to RBAC" }, { "columnId": "Operations", "label": "RBAC Operations" }, { "columnId": "SpnName", "label": "Service Principal" }, { "columnId": "Identity", "label": "Identity" }, { "columnId": "AppIdNorm", "label": "App Id" }, { "columnId": "EntraAppUrl", "label": "App" }, { "columnId": "CredNorm", "label": "Cred Type" }, { "columnId": "UaNorm", "label": "User Agent" }, { "columnId": "FirstSigninIp", "label": "Sign-in IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "SigninIps", "label": "Sign-in IPs" }, { "columnId": "WriteIps", "label": "RBAC Write IPs" }, { "columnId": "FirstSignin", "label": "First Sign-in" }, { "columnId": "FirstRbacWrite", "label": "First RBAC Write" }, { "columnId": "LastRbacWrite", "label": "Last RBAC Write" }, { "columnId": "ResourcesTouched", "label": "Resources Touched" }, { "columnId": "ResourceGroups", "label": "Resource Groups" }, { "columnId": "Subscriptions", "label": "Subscriptions" }, { "columnId": "SpId", "label": "SPN Object Id" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "de-de5-novel-spn-rbac-write", "id": "58948d26-e0e3-4d8f-9c30-f80471f2dd14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let NetworkConfigOps = dynamic([\n \"Microsoft.Network/networkSecurityGroups/write\",\n \"Microsoft.Network/networkSecurityGroups/delete\",\n \"Microsoft.Network/networkSecurityGroups/securityRules/write\",\n \"Microsoft.Network/networkSecurityGroups/securityRules/delete\",\n \"Microsoft.Network/azureFirewalls/write\",\n \"Microsoft.Network/azureFirewalls/delete\",\n \"Microsoft.Network/firewallPolicies/write\",\n \"Microsoft.Network/firewallPolicies/delete\",\n \"Microsoft.Network/firewallPolicies/ruleCollectionGroups/write\",\n \"Microsoft.Network/firewallPolicies/ruleCollectionGroups/delete\",\n \"Microsoft.Network/frontDoorWebApplicationFirewallPolicies/write\",\n \"Microsoft.Network/frontDoorWebApplicationFirewallPolicies/delete\",\n \"Microsoft.Network/virtualNetworkGateways/write\",\n \"Microsoft.Network/virtualNetworkGateways/delete\",\n \"Microsoft.Network/routeTables/write\",\n \"Microsoft.Network/routeTables/delete\",\n \"Microsoft.Network/routeTables/routes/write\",\n \"Microsoft.Network/routeTables/routes/delete\",\n \"Microsoft.Network/virtualNetworks/subnets/write\",\n \"Microsoft.Network/virtualNetworks/subnets/delete\",\n \"Microsoft.Authorization/roleAssignments/write\",\n \"Microsoft.Authorization/roleAssignments/delete\"\n ]);\n let ApplianceIPs =\n DeviceInfo\n | where TimeGenerated between (StartTime .. EndTime)\n | where IsInternetFacing == true\n | where DeviceCategory in~ (\"Network device\", \"Unknown\")\n | summarize arg_max(TimeGenerated, *) by DeviceId\n | join kind=inner (\n DeviceNetworkInfo\n | where TimeGenerated between (StartTime .. EndTime)\n | mv-expand IP = parse_json(IPAddresses)\n | extend ApplianceIP = tostring(IP.IPAddress)\n | where isnotempty(ApplianceIP)\n | where ApplianceIP !in (\"127.0.0.1\", \"::1\", \"0.0.0.0\")\n ) on DeviceId\n | project ApplianceIP, ApplianceName = DeviceName, ApplianceOS = OSPlatform;\n let UEBASignals =\n BehaviorAnalytics\n | where TimeGenerated between (StartTime .. EndTime)\n | summarize\n UEBAInvestigationPriority = max(InvestigationPriority),\n UEBAFirstTimeOp = countif(tostring(ActivityInsights.FirstTimeUserUsedApp) == \"True\"),\n UEBAFirstTimeCountry = countif(tostring(ActivityInsights.FirstTimeUserConnectedFromCountry) == \"True\")\n by UserPrincipalName;\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where ActivityStatusValue == \"Success\"\n | where OperationNameValue in~ (NetworkConfigOps)\n | extend Auth = parse_json(Authorization_d)\n | where not (\n OperationNameValue =~ \"Microsoft.Authorization/roleAssignments/delete\"\n and tostring(Auth.evidence.role) =~ \"PIM Contributor\"\n )\n | extend CallerType = case(\n tostring(Auth.evidence.principalType) =~ \"ServicePrincipal\", \"ServicePrincipal\",\n Caller contains \"@\", \"User\",\n tostring(Auth.evidence.principalType) =~ \"User\", \"User\",\n \"Unknown\")\n | extend CallerUPN = iff(Caller contains \"@\", Caller, \"\")\n | extend ResourceCategory = case(\n OperationNameValue contains \"networkSecurityGroup\", \"NSG\",\n OperationNameValue contains \"firewallPolicies\"\n or OperationNameValue contains \"azureFirewall\", \"Firewall\",\n OperationNameValue contains \"WebApplicationFirewall\", \"WAF\",\n OperationNameValue contains \"virtualNetworkGateway\", \"VPN Gateway\",\n OperationNameValue contains \"routeTable\"\n or OperationNameValue contains \"routes/\", \"Route Table\",\n OperationNameValue contains \"subnets\", \"Subnet\",\n OperationNameValue contains \"roleAssignments\", \"Role Assignment\",\n OperationNameValue)\n | extend ChangeAction = iff(OperationNameValue endswith \"/delete\", \"Delete\", \"Write\")\n | project\n EventTime = TimeGenerated,\n ResourceCategory,\n ChangeAction,\n OperationName = OperationNameValue,\n ResourceGroup,\n ResourceId = _ResourceId,\n Caller,\n CallerType,\n CallerUPN,\n CallerIpAddress,\n SubscriptionId\n | join kind=leftouter UEBASignals on $left.CallerUPN == $right.UserPrincipalName\n | extend UEBAFlagged = isnotempty(UEBAInvestigationPriority) and UEBAInvestigationPriority > 0\n | join kind=leftouter ApplianceIPs on $left.CallerIpAddress == $right.ApplianceIP\n | extend FromApplianceIP = isnotempty(ApplianceName)\n | project-away UserPrincipalName, ApplianceIP\n | extend SignalStrength = case(\n FromApplianceIP, \"High\",\n CallerType == \"ServicePrincipal\" and ChangeAction == \"Delete\", \"High\",\n CallerType == \"ServicePrincipal\", \"Medium\",\n UEBAFlagged and ChangeAction == \"Delete\", \"Medium\",\n UEBAFlagged, \"Medium\",\n \"Low\")\n | extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", CallerIpAddress, \"/overview\")\n | where isempty('{UserFilter}') or CallerUPN contains '{UserFilter}'\n | where isempty('{IPFilter}') or CallerIpAddress contains '{IPFilter}'\n | project-reorder SignalStrength, EventTime, ResourceCategory, ChangeAction,\n CallerUPN, CallerType, CallerIpAddress, XDRIPUrl,\n FromApplianceIP, ApplianceName,\n UEBAFlagged, UEBAInvestigationPriority,\n OperationName, ResourceGroup, ResourceId,\n SubscriptionId\n | limit 25", "size": 0, "title": "Azure Network Config Tampered by Compromised Identity", "noDataMessage": "βœ… No Azure network security control changes in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SignalStrength", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "ChangeAction", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Delete", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Write", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "CallerType", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "ServicePrincipal", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Unknown", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "FromApplianceIP", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "warning", "text": "⚠️ Appliance IP" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "UEBAFlagged", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "warning", "text": "⚠️ Flagged" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "EventTime", "formatter": 6 } ], "labelSettings": [ { "columnId": "SignalStrength", "label": "Signal Strength" }, { "columnId": "EventTime", "label": "Event Time" }, { "columnId": "ResourceCategory", "label": "Resource Type" }, { "columnId": "ChangeAction", "label": "Action" }, { "columnId": "CallerUPN", "label": "Caller UPN" }, { "columnId": "CallerType", "label": "Caller Type" }, { "columnId": "CallerIpAddress", "label": "Caller IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "FromApplianceIP", "label": "From Appliance" }, { "columnId": "ApplianceName", "label": "Appliance" }, { "columnId": "UEBAFlagged", "label": "UEBA Flagged" }, { "columnId": "UEBAInvestigationPriority", "label": "UEBA Priority" }, { "columnId": "OperationName", "label": "Operation" }, { "columnId": "ResourceGroup", "label": "Resource Group" }, { "columnId": "ResourceId", "label": "Resource Id" }, { "columnId": "SubscriptionId", "label": "Subscription" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "de-de6-network-config-tamper", "id": "ffa2256a-3fa4-42f1-956a-6fee68fbbda0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Time and tuning parameters.\r\nlet StartTime = {TimeRange:start};\r\nlet EndTime = {TimeRange:end};\r\nlet ProcToK8sWindow = 20m;\r\n let K8sToCloudWindow = 45m;\r\n // Stage A: process-level signs of token access or cloud token exchange tooling in pods.\r\n let PodTokenTooling =\r\n CloudProcessEvents\r\n | where Timestamp between (StartTime .. EndTime)\r\n | where isnotempty(KubernetesNamespace) and isnotempty(KubernetesPodName)\r\n | extend NamespaceNorm = tolower(tostring(KubernetesNamespace)),\r\n PodNorm = tolower(tostring(KubernetesPodName)),\r\n Cmd = tolower(tostring(ProcessCommandLine)),\r\n Proc = tolower(tostring(ProcessName)),\r\n ParentProc = tolower(tostring(ParentProcessName))\r\n | where Cmd has_any (\r\n '/var/run/secrets/kubernetes.io/serviceaccount/token',\r\n 'azure_federated_token_file',\r\n 'oauth2/v2.0/token',\r\n 'login.microsoft.com',\r\n 'sts.windows.net',\r\n 'az login',\r\n 'get-azaccesstoken'\r\n )\r\n or (Proc has_any ('az', 'curl', 'wget', 'kubectl', 'pwsh', 'python')\r\n and Cmd has_any ('token', 'federated', 'oauth2', 'login.microsoftonline', 'sts.windows.net', 'serviceaccount'))\r\n | project ProcTime=Timestamp, NamespaceNorm, PodNorm, KubernetesResource, ContainerName, ContainerImageName,\r\n ProcessName, ParentProcessName, ProcessCommandLine, AzureResourceId, ContainerId;\r\n // Stage B: Kubernetes audit events that can expose token-abuse precursor context, including source IP.\r\n let K8sAuditBridge =\r\n CloudAuditEvents\r\n | where TimeGenerated between (StartTime .. EndTime)\r\n | where DataSource has 'Kubernetes'\r\n | extend AF = todynamic(AdditionalFields)\r\n | extend NamespaceNorm = tolower(coalesce(tostring(AF.KubernetesNamespace), tostring(extractjson('$.objectRef.namespace', tostring(RawEventData))))),\r\n PodNorm = tolower(coalesce(tostring(AF.KubernetesPodName), tostring(extractjson('$.objectRef.name', tostring(RawEventData))))),\r\n OpNorm = tolower(tostring(OperationName)),\r\n IpNorm = tostring(IPAddress),\r\n UaNorm = tostring(UserAgent)\r\n | where isnotempty(NamespaceNorm) and isnotempty(PodNorm) and isnotempty(IpNorm)\r\n | where OpNorm has_any (\r\n 'pods/exec',\r\n 'pods/attach',\r\n 'serviceaccounts/token',\r\n 'tokenreviews',\r\n 'secrets/get',\r\n 'serviceaccounts/get'\r\n )\r\n | project K8sAuditTime=TimeGenerated, NamespaceNorm, PodNorm, IpNorm, UaNorm, K8sOperation=OperationName, K8sResourceId=CloudResourceId;\r\n // Stage C: Azure RBAC write operations from CloudAuditEvents.\r\n let CloudRbacWrites =\r\n CloudAuditEvents\r\n | where TimeGenerated between (StartTime .. EndTime)\r\n | where DataSource has 'Azure'\r\n | extend OpNorm = tolower(tostring(OperationName)),\r\n IpNorm = tostring(IPAddress),\r\n UaNorm = tostring(UserAgent)\r\n | where isnotempty(IpNorm)\r\n | where OpNorm contains 'microsoft.authorization/roleassignments/'\r\n or OpNorm contains 'microsoft.authorization/roledefinitions/'\r\n | project CloudTime=TimeGenerated, IpNorm, UaNorm, CloudOperation=OperationName, CloudResourceId, ActionType, CountryCode, IsAnonymousProxy;\r\n // Correlate A->B by namespace/pod and near-time.\r\n PodTokenTooling\r\n | join kind=inner K8sAuditBridge on NamespaceNorm, PodNorm\r\n | where K8sAuditTime between (ProcTime .. (ProcTime + ProcToK8sWindow))\r\n // Correlate B->C by source IP and near-time to represent k8s-to-cloud pivot.\r\n | join kind=inner CloudRbacWrites on IpNorm\r\n | where CloudTime between (K8sAuditTime .. (K8sAuditTime + K8sToCloudWindow))\r\n | summarize FirstProcess=min(ProcTime),\r\n FirstK8sAudit=min(K8sAuditTime),\r\n FirstCloudWrite=min(CloudTime),\r\n LastCloudWrite=max(CloudTime),\r\n CloudWriteCount=count(),\r\n K8sOps=make_set(K8sOperation, 10),\r\n CloudOps=make_set(CloudOperation, 10),\r\n CloudResources=make_set(CloudResourceId, 20),\r\n Countries=make_set(CountryCode, 5),\r\n AnyAnonymousProxy=max(toint(IsAnonymousProxy))\r\n by NamespaceNorm, PodNorm, IpNorm, ContainerName, ContainerImageName, ProcessName, ParentProcessName, ProcessCommandLine\r\n | extend TimeGenerated = FirstProcess,\r\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", IpNorm, \"/overview\")\r\n | project TimeGenerated, CloudWriteCount, AnyAnonymousProxy, K8sOps, CloudOps,\r\n NamespaceNorm, PodNorm, IpNorm, XDRIPUrl, Countries,\r\n ContainerName, ContainerImageName, ProcessName, ParentProcessName, ProcessCommandLine,\r\n FirstProcess, FirstK8sAudit, FirstCloudWrite, LastCloudWrite, CloudResources\r\n | where isempty('{UserFilter}') or PodNorm contains '{UserFilter}' or NamespaceNorm contains '{UserFilter}'\r\n | where isempty('{IPFilter}') or IpNorm contains '{IPFilter}'\r\n | order by CloudWriteCount desc, FirstCloudWrite desc\r\n | limit 25", "size": 0, "title": "Pod token tooling then cloud RBAC write", "noDataMessage": "βœ… No pod token tooling chained to cloud RBAC writes in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "CloudWriteCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "AnyAnonymousProxy", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "warning", "text": "⚠️ Anon Proxy" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "No" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstProcess", "formatter": 6 }, { "columnMatch": "FirstK8sAudit", "formatter": 6 }, { "columnMatch": "FirstCloudWrite", "formatter": 6 }, { "columnMatch": "LastCloudWrite", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Process Time" }, { "columnId": "CloudWriteCount", "label": "Cloud RBAC Writes" }, { "columnId": "AnyAnonymousProxy", "label": "Anon Proxy" }, { "columnId": "K8sOps", "label": "K8s Operations" }, { "columnId": "CloudOps", "label": "Cloud Operations" }, { "columnId": "NamespaceNorm", "label": "Namespace" }, { "columnId": "PodNorm", "label": "Pod" }, { "columnId": "IpNorm", "label": "Source IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "Countries", "label": "Countries" }, { "columnId": "ContainerName", "label": "Container" }, { "columnId": "ContainerImageName", "label": "Image" }, { "columnId": "ProcessName", "label": "Process" }, { "columnId": "ParentProcessName", "label": "Parent Process" }, { "columnId": "ProcessCommandLine", "label": "Command Line" }, { "columnId": "FirstProcess", "label": "First Process" }, { "columnId": "FirstK8sAudit", "label": "First K8s Audit" }, { "columnId": "FirstCloudWrite", "label": "First Cloud Write" }, { "columnId": "LastCloudWrite", "label": "Last Cloud Write" }, { "columnId": "CloudResources", "label": "Cloud Resources" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "de-de7-pod-token-cloud-rbac", "id": "ee462ca0-470c-4053-8c50-c789ac9593f1" } ] }, "conditionalVisibility": { "parameterName": "isDefenseEvasionVisible", "comparison": "isEqualTo", "value": "true" }, "name": "section-4-DefenseEvasion", "id": "5d9aac4e-0114-4db2-90fb-005c98e083b1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## 🟀 Credential Access\nKey Vault secret reads/harvests preceding partial storage exfil, SPN sign-ins with out-of-scope resource access, novel SPN sign-ins from non-first-party IPs, and Kubernetes token audits preceding novel cloud control-plane operations.\n\n**MITRE:** T1552.001 Β· T1528 Β· T1550.001 Β· T1606 \n**Key tables:** AzureActivity Β· AADServicePrincipalSignInLogs Β· AzureDiagnostics" }, "name": "section-8-text", "id": "1d8b4c45-a8ad-4224-912a-15d7794f6ed8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Execution window and thresholds.\nlet StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet PivotWindow = 4h;\nlet SuccessActivity = dynamic([\"succeeded\", \"success\"]);\nlet KeyAuthTypes = dynamic([\"accountkey\", \"sas\"]);\nlet MinStorageOps = 25;\nlet MinFailures = 3;\nlet MinReads = 8;\n// Stage A: successful Key Vault secret retrieval from management plane telemetry.\nlet KeyVaultSecretReads =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where isnotempty(Caller) and isnotempty(CallerIpAddress)\n | extend CallerNorm=tolower(Caller), CallerIp=tostring(CallerIpAddress),\n Op=tolower(OperationNameValue),\n Status=tolower(tostring(ActivityStatusValue)),\n SubStatus=tolower(tostring(ActivitySubstatusValue))\n | where Op has \"microsoft.keyvault/vaults/secrets/\"\n | where Op in~ (\"microsoft.keyvault/vaults/secrets/get\", \"microsoft.keyvault/vaults/secrets/read\")\n | where Status in (SuccessActivity) or SubStatus has \"ok\"\n // Collapse duplicate activity stages into one logical secret-read action.\n | extend ActionKey = iff(\n isnotempty(CorrelationId),\n strcat(CorrelationId, \"|\", CallerNorm, \"|\", Op, \"|\", tostring(ResourceId)),\n strcat(CallerNorm, \"|\", CallerIp, \"|\", tostring(SubscriptionId), \"|\", Op, \"|\", tostring(ResourceId), \"|\", tostring(bin(TimeGenerated, 1m)))\n )\n | summarize arg_min(TimeGenerated, *) by ActionKey\n | summarize FirstKvRead=min(TimeGenerated), LastKvRead=max(TimeGenerated),\n KvReadCount=count(), KvOps=make_set(OperationNameValue, 20),\n KvResources=make_set(ResourceId, 30)\n by CallerNorm, CallerIp;\n// Stage B: key-auth storage activity with per-actor summary.\nlet StorageActivity =\n CloudStorageAggregatedEvents\n | where TimeGenerated between (StartTime .. EndTime)\n | extend ActorNorm=tolower(tostring(coalesce(AccountUpn, AccountObjectId, AccountApplicationId))),\n IpNorm=tostring(IpAddress),\n AuthNorm=tolower(tostring(AuthenticationType)),\n StorageNorm=tolower(tostring(StorageAccount))\n | where isnotempty(ActorNorm) and isnotempty(IpNorm) and isnotempty(StorageNorm)\n | where AuthNorm in (KeyAuthTypes)\n | summarize FirstStorage=min(TimeGenerated), LastStorage=max(TimeGenerated),\n StorageEvents=count(), StorageAccounts=dcount(StorageNorm),\n TotalOps=sum(tolong(coalesce(OperationsCount, 0))),\n TotalSuccess=sum(tolong(coalesce(SuccessfulOperationsCount, 0))),\n TotalFailures=sum(tolong(coalesce(FailedOperationsCount, 0))),\n TotalReads=sum(tolong(coalesce(SuccessfulReadOperations, 0))),\n TotalResponseBytes=sum(tolong(coalesce(TotalResponseLength, 0))),\n Services=make_set(ServiceType, 10),\n Accounts=make_set(StorageAccount, 30),\n Containers=make_set(StorageContainer, 30),\n UserAgents=make_set(UserAgentHeader, 10)\n by ActorNorm, IpNorm;\n// Stage correlation: secret retrieval followed by mixed-outcome storage behavior.\nKeyVaultSecretReads\n| join kind=inner StorageActivity on $left.CallerNorm == $right.ActorNorm and $left.CallerIp == $right.IpNorm\n| where FirstStorage between (FirstKvRead .. (LastKvRead + PivotWindow))\n// Require meaningful activity and explicit mixed outcomes.\n| where TotalOps >= MinStorageOps and TotalReads >= MinReads and TotalFailures >= MinFailures\n| where TotalSuccess > 0 and TotalFailures > 0\n| extend IdentityName = iff(CallerNorm contains \"@\", tostring(split(CallerNorm, \"@\")[0]), CallerNorm),\n IdentityUPNSuffix = iff(CallerNorm contains \"@\", tostring(split(CallerNorm, \"@\")[1]), \"\"),\n FailureToSuccessRatio = round(todouble(TotalFailures) / todouble(max_of(TotalSuccess, 1)), 3)\n| project TimeGenerated=FirstKvRead,\n Identity=CallerNorm, IdentityName, IdentityUPNSuffix,\n SourceIp=CallerIp,\n FirstKvRead, LastKvRead, KvReadCount, KvOps, KvResources,\n FirstStorage, LastStorage,\n StorageEvents, StorageAccounts,\n TotalOps, TotalSuccess, TotalFailures, FailureToSuccessRatio,\n TotalReads, TotalResponseBytes,\n Services, Accounts, Containers, UserAgents\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", SourceIp, \"/overview\")\n| project-reorder TimeGenerated, FailureToSuccessRatio, TotalReads, TotalFailures, TotalSuccess, TotalOps, Identity, SourceIp, XDRIPUrl, StorageAccounts, StorageEvents\n| where isempty('{UserFilter}') or Identity contains '{UserFilter}'\n| where isempty('{IPFilter}') or SourceIp contains '{IPFilter}'\n| order by TotalReads desc, TotalFailures desc\n| limit 25", "size": 0, "title": "Key Vault secret read then partial storage exfil", "noDataMessage": "βœ… No Key Vault secret reads followed by partial storage exfil in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "FailureToSuccessRatio", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "1", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "0.3", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "TotalReads", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "50", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "8", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "TotalFailures", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstKvRead", "formatter": 6 }, { "columnMatch": "LastKvRead", "formatter": 6 }, { "columnMatch": "FirstStorage", "formatter": 6 }, { "columnMatch": "LastStorage", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "KV Read Time" }, { "columnId": "FailureToSuccessRatio", "label": "Fail:Success Ratio" }, { "columnId": "TotalReads", "label": "Reads" }, { "columnId": "TotalFailures", "label": "Failures" }, { "columnId": "TotalSuccess", "label": "Successes" }, { "columnId": "TotalOps", "label": "Storage Ops" }, { "columnId": "Identity", "label": "Identity" }, { "columnId": "SourceIp", "label": "Source IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "StorageAccounts", "label": "Storage Accounts" }, { "columnId": "StorageEvents", "label": "Storage Events" }, { "columnId": "TotalResponseBytes", "label": "Bytes Read" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "ca-ca1-kv-storage-exfil", "id": "d3468b41-19ea-4a57-b244-d76e10ef5cce" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Time and tuning parameters\nlet StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineWindow = 14d;\nlet PivotWindow = 6h;\nlet ScopeWindow = 6h;\nlet SuccessStatus = dynamic(['succeeded', 'success']);\n// Stage A: successful Key Vault secret retrieval\nlet KvSecretReads =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where isnotempty(Caller) and isnotempty(CallerIpAddress)\n | extend CallerNorm = tolower(tostring(Caller)),\n CallerIp = tostring(CallerIpAddress),\n Op = tolower(tostring(OperationNameValue)),\n Status = tolower(tostring(ActivityStatusValue)),\n SubStatus = tolower(tostring(ActivitySubstatusValue))\n | where Op has 'microsoft.keyvault/vaults/' and Op has '/secrets/'\n | where Op has_any ('/get', '/read')\n | where Status in (SuccessStatus) or SubStatus has 'ok'\n | summarize FirstKvRead=min(TimeGenerated), LastKvRead=max(TimeGenerated), KvReadCount=count() by CallerNorm, CallerIp;\n// Stage B: successful SPN sign-ins in timeframe\nlet SpnSignins =\n AADServicePrincipalSignInLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where ResultType =~ 'Success' or ResultType == '0'\n | extend SpId = tolower(tostring(ServicePrincipalId)),\n AppIdNorm = tolower(tostring(AppId)),\n SigninIp = tostring(IPAddress),\n UaNorm = tostring(UserAgent),\n CredNorm = tostring(ClientCredentialType)\n | where isnotempty(SpId) and isnotempty(SigninIp)\n | project SigninTime = TimeGenerated, SpId, AppIdNorm, SpnName = tostring(ServicePrincipalName), Identity, SigninIp, UaNorm, CredNorm;\n// Baseline historical scope touched by each principal in control\nlet ScopeBaseline =\n AzureActivity\n | where TimeGenerated between ((StartTime - BaselineWindow) .. StartTime)\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(tostring(Caller)),\n ScopeKey = tolower(tostring(coalesce(ResourceGroup, ResourceId, SubscriptionId))),\n Provider = tostring(ResourceProviderValue)\n | where isnotempty(ScopeKey)\n | summarize by CallerNorm, ScopeKey, Provider;\n// Current scope touched by caller after suspicious SPN authentication\nlet ScopeCurrent =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(tostring(Caller)),\n ScopeKey = tolower(tostring(coalesce(ResourceGroup, ResourceId, SubscriptionId))),\n Provider = tostring(ResourceProviderValue),\n Op = tostring(OperationNameValue)\n | where isnotempty(ScopeKey)\n | project ActTime = TimeGenerated, CallerNorm, ScopeKey, Provider, Op, ResourceId, ResourceGroup, SubscriptionId, CallerIpAddress;\n// Keep only novel scope for each caller.\nlet ScopeNovel =\n ScopeCurrent\n | join kind=leftanti ScopeBaseline on CallerNorm, ScopeKey, Provider;\n// Correlate full chain: KeyVault read -> SPN sign-in -> novel scope\nKvSecretReads\n| join kind=inner (\n SpnSignins\n | extend JoinKeys = pack_array(SpId, AppIdNorm)\n | mv-expand JoinKey = JoinKeys\n | extend JoinKey = tostring(JoinKey)\n | project SigninTime, SpId, AppIdNorm, SpnName, Identity, SigninIp, UaNorm, CredNorm, JoinKey\n ) on $left.CallerNorm == $right.JoinKey and $left.CallerIp == $right.SigninIp\n| where SigninTime between (FirstKvRead .. (LastKvRead + PivotWindow))\n| join kind=inner ScopeNovel on $left.CallerNorm == $right.CallerNorm\n| where ActTime between (SigninTime .. (SigninTime + ScopeWindow))\n| summarize FirstKvRead=min(FirstKvRead),\n FirstSignin=min(SigninTime),\n FirstNovelScope=min(ActTime),\n NovelScopeCount=dcount(ScopeKey),\n Providers=make_set(Provider, 15),\n Operations=make_set(Op, 20),\n Scopes=make_set(ScopeKey, 30),\n ResourceIds=make_set(ResourceId, 20),\n ResourceGroups=make_set(ResourceGroup, 20),\n Subscriptions=make_set(SubscriptionId, 10)\n by CallerNorm, CallerIp, SpId, AppIdNorm, SpnName, Identity, UaNorm, CredNorm\n| extend TimeGenerated = FirstKvRead\n| where NovelScopeCount >= 2\n| project TimeGenerated,\n Identity = CallerNorm,\n SourceIp = CallerIp,\n ServicePrincipalId = SpId,\n AppId = AppIdNorm,\n ServicePrincipalName = SpnName,\n FirstKvRead,\n FirstSignin,\n FirstNovelScope,\n NovelScopeCount,\n Providers,\n Operations,\n Scopes,\n ResourceIds,\n ResourceGroups,\n Subscriptions,\n UserAgent = UaNorm,\n ClientCredentialType = CredNorm\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", SourceIp, \"/overview\"),\n EntraAppUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/\", ServicePrincipalId, \"/appId/\", AppId)\n| project-reorder TimeGenerated, NovelScopeCount, ServicePrincipalName, Identity, SourceIp, XDRIPUrl, AppId, EntraAppUrl, Operations, Scopes, Providers\n| where isempty('{UserFilter}') or Identity contains '{UserFilter}'\n| where isempty('{IPFilter}') or SourceIp contains '{IPFilter}'\n| order by NovelScopeCount desc, FirstNovelScope desc\n| limit 25", "size": 0, "title": "Key Vault harvest to SPN sign-in then out-of-scope resource access", "noDataMessage": "βœ… No Key Vault harvest followed by SPN sign-in and out-of-scope access in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "NovelScopeCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "EntraAppUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— App Reg" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstKvRead", "formatter": 6 }, { "columnMatch": "FirstSignin", "formatter": 6 }, { "columnMatch": "FirstNovelScope", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "KV Read Time" }, { "columnId": "NovelScopeCount", "label": "Novel Scopes" }, { "columnId": "ServicePrincipalName", "label": "Service Principal" }, { "columnId": "Identity", "label": "Identity" }, { "columnId": "SourceIp", "label": "Source IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "AppId", "label": "App Id" }, { "columnId": "EntraAppUrl", "label": "App" }, { "columnId": "Operations", "label": "Operations" }, { "columnId": "Scopes", "label": "Scopes" }, { "columnId": "Providers", "label": "Providers" }, { "columnId": "FirstSignin", "label": "SPN Sign-in" }, { "columnId": "FirstNovelScope", "label": "First Novel Scope" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "ca-ca2-kv-spn-scopedrift", "id": "04a1f906-3402-46a2-95ad-467a45e60a70" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Hunt window and tuning knobs.\nlet StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineWindow = 14d;\nlet PivotWindow = 60m;\n// Optional allowlist for approved external automation sources.\nlet ApprovedPublicIps = dynamic([]);\n// Stage A: successful Key Vault secret reads.\nlet KvReads =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | extend Op = tolower(OperationNameValue),\n Status = tolower(tostring(ActivityStatusValue)),\n SubStatus = tolower(tostring(ActivitySubstatusValue)),\n CallerIp = tostring(CallerIpAddress),\n CallerNorm = tolower(tostring(Caller))\n // Keep only successful secret read actions from Key Vault provider paths.\n | where Op has \"microsoft.keyvault/vaults/\" and Op has \"/secrets/\" and Op has_any (\"/get\", \"/read\")\n | where Status in (dynamic([\"success\", \"succeeded\"])) or SubStatus has \"ok\"\n | where isnotempty(CallerIp)\n | summarize FirstKvRead=min(TimeGenerated), LastKvRead=max(TimeGenerated), KvReadCount=count(),\n KvOps=make_set(OperationNameValue, 15), KvResources=make_set(ResourceId, 25), KvCallers=make_set(CallerNorm, 15)\n by CallerIp;\n// Baseline SPN sign-in tuples over prior 14 days.\nlet SpnBaseline =\n AADServicePrincipalSignInLogs\n | where TimeGenerated between ((StartTime - BaselineWindow) .. StartTime)\n | extend SpnId = tolower(tostring(ServicePrincipalId)),\n AppIdNorm = tolower(tostring(AppId)),\n IpNorm = tostring(IPAddress),\n UserAgentNorm = tostring(UserAgent),\n CredType = tolower(tostring(ClientCredentialType)),\n ResultNorm = tolower(tostring(ResultType))\n | where isnotempty(SpnId) and isnotempty(IpNorm)\n | where ResultNorm in (dynamic([\"0\", \"success\", \"succeeded\"]))\n | summarize by SpnId, AppIdNorm, IpNorm, UserAgentNorm, CredType;\n// Current SPN sign-ins in hunt window.\nlet SpnCurrent =\n AADServicePrincipalSignInLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | extend SpnId = tolower(tostring(ServicePrincipalId)),\n SpnName = tostring(ServicePrincipalName),\n AppIdNorm = tolower(tostring(AppId)),\n IpNorm = tostring(IPAddress),\n UserAgentNorm = tostring(UserAgent),\n CredType = tolower(tostring(ClientCredentialType)),\n ResultNorm = tolower(tostring(ResultType)),\n Asn = tostring(AutonomousSystemNumber)\n | where isnotempty(SpnId) and isnotempty(IpNorm)\n | where ResultNorm in (dynamic([\"0\", \"success\", \"succeeded\"]));\n// Keep novel tuples only to highlight new SPN behavior.\nlet SpnNovel =\n SpnCurrent\n | join kind=leftanti SpnBaseline on SpnId, AppIdNorm, IpNorm, UserAgentNorm, CredType\n // Approximate non-1P network by public IP not present in local allowlist.\n | where not(ipv4_is_private(IpNorm))\n | where IpNorm !in (ApprovedPublicIps);\n// Sequence correlation: Key Vault read from source IP before novel SPN sign-in.\nKvReads\n| join kind=inner SpnNovel on $left.CallerIp == $right.IpNorm\n| where TimeGenerated between (FirstKvRead .. (LastKvRead + PivotWindow))\n| summarize FirstKvRead=min(FirstKvRead), LastKvRead=max(LastKvRead), KvReadCount=max(KvReadCount),\n FirstSpnSignin=min(TimeGenerated), LastSpnSignin=max(TimeGenerated), SpnSigninCount=count(),\n KvOps=any(KvOps), KvResources=any(KvResources), KvCallers=any(KvCallers),\n UserAgents=make_set(UserAgentNorm, 10), CredentialTypes=make_set(CredType, 8),\n ASNs=make_set(Asn, 8), Resources=make_set(ResourceDisplayName, 15)\n by SourceIp=IpNorm, ServicePrincipalId=SpnId, ServicePrincipalName=SpnName, AppId=AppIdNorm\n| extend TimeGenerated = FirstSpnSignin\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", SourceIp, \"/overview\"),\n EntraAppUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/\", ServicePrincipalId, \"/appId/\", AppId)\n| project-reorder TimeGenerated, SpnSigninCount, KvReadCount, ServicePrincipalName, SourceIp, XDRIPUrl, AppId, EntraAppUrl, ASNs, UserAgents, CredentialTypes\n| where isempty('{UserFilter}') or ServicePrincipalName contains '{UserFilter}'\n| where isempty('{IPFilter}') or SourceIp contains '{IPFilter}'\n| order by FirstSpnSignin desc\n| limit 25", "size": 0, "title": "Key Vault secret harvest followed by novel SPN sign-in from non-1P IP", "noDataMessage": "βœ… No Key Vault harvest followed by novel SPN sign-in from a non-1P IP in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "SpnSigninCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "KvReadCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "EntraAppUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— App Reg" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstKvRead", "formatter": 6 }, { "columnMatch": "LastKvRead", "formatter": 6 }, { "columnMatch": "FirstSpnSignin", "formatter": 6 }, { "columnMatch": "LastSpnSignin", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "SPN Sign-in Time" }, { "columnId": "SpnSigninCount", "label": "SPN Sign-ins" }, { "columnId": "KvReadCount", "label": "KV Reads" }, { "columnId": "ServicePrincipalName", "label": "Service Principal" }, { "columnId": "SourceIp", "label": "Source IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "AppId", "label": "App Id" }, { "columnId": "EntraAppUrl", "label": "App" }, { "columnId": "ASNs", "label": "ASNs" }, { "columnId": "UserAgents", "label": "User Agents" }, { "columnId": "CredentialTypes", "label": "Cred Types" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "ca-ca3-kv-novel-spn-non1p", "id": "17f21101-c336-42e4-bd6a-114c4ab0699a" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// Time and tuning parameters.\nlet StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineWindow = 14d;\nlet PivotWindow = 60m;\n// Stage A: k8s audit indicators associated with token and workload execution paths.\nlet K8sTokenAudit =\n CloudAuditEvents\n | where TimeGenerated between (StartTime .. EndTime)\n | where DataSource has 'Kubernetes'\n | extend AF = todynamic(AdditionalFields)\n | extend OpNorm = tolower(tostring(OperationName)),\n IpNorm = tostring(IPAddress),\n UaNorm = tostring(UserAgent),\n NamespaceNorm = tolower(coalesce(tostring(AF.KubernetesNamespace), tostring(extractjson('$.objectRef.namespace', tostring(RawEventData))))),\n PodNorm = tolower(coalesce(tostring(AF.KubernetesPodName), tostring(extractjson('$.objectRef.name', tostring(RawEventData)))))\n | where isnotempty(IpNorm)\n | where OpNorm has_any (\n 'serviceaccounts/token',\n 'tokenreviews',\n 'pods/exec',\n 'pods/attach',\n 'secrets/get'\n )\n | summarize FirstK8s=min(TimeGenerated), LastK8s=max(TimeGenerated), K8sEventCount=count(), K8sOps=make_set(OperationName, 10)\n by IpNorm, UaNorm, NamespaceNorm, PodNorm;\n// Build historical baseline of cloud operation tuples to identify first-seen pivots.\nlet CloudOpBaseline =\n CloudAuditEvents\n | where TimeGenerated between ((StartTime - BaselineWindow) .. StartTime)\n | where DataSource has 'Azure'\n | extend OpNorm = tolower(tostring(OperationName)),\n IpNorm = tostring(IPAddress),\n UaNorm = tostring(UserAgent)\n | where isnotempty(IpNorm) and isnotempty(OpNorm)\n | summarize by IpNorm, UaNorm, OpNorm;\n// Current sensitive cloud control-plane operations.\nlet CloudSensitiveCurrent =\n CloudAuditEvents\n | where TimeGenerated between (StartTime .. EndTime)\n | where DataSource has 'Azure'\n | extend OpNorm = tolower(tostring(OperationName)),\n IpNorm = tostring(IPAddress),\n UaNorm = tostring(UserAgent)\n | where isnotempty(IpNorm) and isnotempty(UaNorm)\n | where OpNorm contains 'microsoft.authorization/roleassignments/'\n or OpNorm contains 'microsoft.authorization/roledefinitions/'\n or OpNorm contains 'microsoft.keyvault/vaults/'\n or OpNorm contains 'microsoft.storage/storageaccounts/listkeys/action'\n or OpNorm contains 'microsoft.resources/subscriptions/read'\n | project CloudTime=TimeGenerated, IpNorm, UaNorm, OpNorm, OperationName, CloudResourceId, ActionType, CountryCode, IsAnonymousProxy;\n// Keep only novel cloud operation tuples for high-fidelity behavior change.\nlet CloudSensitiveNovel =\n CloudSensitiveCurrent\n | join kind=leftanti CloudOpBaseline on IpNorm, UaNorm, OpNorm;\n// Correlate k8s precursor to novel cloud control-plane behavior.\nK8sTokenAudit\n| where isnotempty(UaNorm)\n| join kind=inner CloudSensitiveNovel on IpNorm, UaNorm\n| where CloudTime between (FirstK8s .. (LastK8s + PivotWindow))\n| summarize FirstK8s=min(FirstK8s),\n LastK8s=max(LastK8s),\n FirstCloud=min(CloudTime),\n LastCloud=max(CloudTime),\n K8sEventCount=max(K8sEventCount),\n CloudEventCount=count(),\n K8sOps=any(K8sOps),\n CloudOps=make_set(OperationName, 15),\n CloudResources=make_set(CloudResourceId, 20),\n Countries=make_set(CountryCode, 5),\n AnyAnonymousProxy=max(toint(IsAnonymousProxy))\n by IpNorm, UaNorm, NamespaceNorm, PodNorm\n| extend TimeGenerated = FirstK8s\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", IpNorm, \"/overview\")\n| project-reorder TimeGenerated, CloudEventCount, AnyAnonymousProxy, IpNorm, XDRIPUrl, NamespaceNorm, PodNorm, K8sOps, CloudOps, Countries\n| where isempty('{UserFilter}') or PodNorm contains '{UserFilter}'\n| where isempty('{IPFilter}') or IpNorm contains '{IPFilter}'\n| order by CloudEventCount desc, FirstCloud desc\n| limit 25", "size": 0, "title": "K8s token audit then novel cloud control plane operations", "noDataMessage": "βœ… No K8s token audit followed by novel cloud control-plane operations in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "CloudEventCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "AnyAnonymousProxy", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "1", "representation": "warning", "text": "⚠️ Anon Proxy" }, { "operator": "Default", "thresholdValue": null, "representation": "success", "text": "No" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstK8s", "formatter": 6 }, { "columnMatch": "LastK8s", "formatter": 6 }, { "columnMatch": "FirstCloud", "formatter": 6 }, { "columnMatch": "LastCloud", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "K8s Time" }, { "columnId": "CloudEventCount", "label": "Cloud Ops" }, { "columnId": "AnyAnonymousProxy", "label": "Anon Proxy" }, { "columnId": "IpNorm", "label": "Source IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "NamespaceNorm", "label": "Namespace" }, { "columnId": "PodNorm", "label": "Pod" }, { "columnId": "K8sOps", "label": "K8s Ops" }, { "columnId": "CloudOps", "label": "Cloud Operations" }, { "columnId": "Countries", "label": "Countries" }, { "columnId": "CloudResources", "label": "Cloud Resources" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "ca-ca4-k8s-novel-cloud", "id": "571b61e4-38c5-42f5-98ea-508133054256" } ] }, "conditionalVisibility": { "parameterName": "isCredentialAccessVisible", "comparison": "isEqualTo", "value": "true" }, "name": "section-5-CredentialAccess", "id": "28024888-34ea-436d-81ea-be7925c3c7fc" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## πŸ”΅ Discovery\nIAM/subscription enumeration preceding Key Vault operations, identity & app enumeration before novel non-interactive sign-ins, Key Vault discovery into data-store access, and OAuth consent change preceding first-seen app bursts β€” plus top Key Vault callers and bursting apps.\n\n**MITRE:** T1087 Β· T1526 Β· T1069 Β· T1538 \n**Key tables:** AzureActivity Β· AADNonInteractiveUserSignInLogs Β· CloudAppEvents Β· AzureDiagnostics Β· _Im_AuditEvent" }, "name": "section-5-text", "id": "9ef51bfc-0ce9-4b48-acfc-dfa1f6a275d4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let IamRecon =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationNameValue has_any (\n \"microsoft.authorization/roleassignments/read\",\n \"microsoft.authorization/roledefinitions/read\",\n \"microsoft.resources/subscriptions/read\",\n \"microsoft.resources/subscriptions/resourcegroups/read\",\n \"microsoft.resources/subscriptions/resourcegroups/resources/read\",\n \"microsoft.resources/subscriptions/providers/read\"\n )\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(Caller), CallerIp = tostring(CallerIpAddress)\n | summarize EnumCount=count(), EnumOps=make_set(OperationNameValue, 20), FirstEnum=min(TimeGenerated), LastEnum=max(TimeGenerated)\n by CallerNorm, CallerIp, SubscriptionId;\n let KeyVaultOps =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationNameValue has \"microsoft.keyvault/vaults/\"\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(Caller), CallerIp = tostring(CallerIpAddress)\n | summarize KvCount=count(), KvOps=make_set(OperationNameValue, 20), FirstKv=min(TimeGenerated), LastKv=max(TimeGenerated),\n Resources=make_set(ResourceId, 20)\n by CallerNorm, CallerIp, SubscriptionId;\n IamRecon\n | join kind=inner KeyVaultOps on CallerNorm, SubscriptionId\n | where FirstKv between (FirstEnum .. (LastEnum + 2h))\n | where isempty('{UserFilter}') or CallerNorm contains '{UserFilter}'\n | where isempty('{IPFilter}') or CallerIp contains '{IPFilter}'\n | summarize KvCount = sum(KvCount) by Caller = CallerNorm\n | top 10 by KvCount\n | render barchart", "size": 0, "title": "Top Callers by Key Vault Activity", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "xAxis": "Caller", "yAxis": [ "KvCount" ], "createOtherGroup": null } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "dc-d1-iam-enum-kv-topcallers", "id": "2f2d414d-d0f5-4c73-b940-326f05980d73" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet IamRecon =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationNameValue has_any (\n \"microsoft.authorization/roleassignments/read\",\n \"microsoft.authorization/roledefinitions/read\",\n \"microsoft.resources/subscriptions/read\",\n \"microsoft.resources/subscriptions/resourcegroups/read\",\n \"microsoft.resources/subscriptions/resourcegroups/resources/read\",\n \"microsoft.resources/subscriptions/providers/read\"\n )\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(Caller), CallerIp = tostring(CallerIpAddress)\n | summarize EnumCount=count(), EnumOps=make_set(OperationNameValue, 20), FirstEnum=min(TimeGenerated), LastEnum=max(TimeGenerated)\n by CallerNorm, CallerIp, SubscriptionId;\nlet KeyVaultOps =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationNameValue has \"microsoft.keyvault/vaults/\"\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(Caller), CallerIp = tostring(CallerIpAddress)\n | summarize KvCount=count(), KvOps=make_set(OperationNameValue, 20), FirstKv=min(TimeGenerated), LastKv=max(TimeGenerated),\n Resources=make_set(ResourceId, 20)\n by CallerNorm, CallerIp, SubscriptionId;\nIamRecon\n| join kind=inner KeyVaultOps on CallerNorm, SubscriptionId\n| where FirstKv between (FirstEnum .. (LastEnum + 2h))\n| extend EnumOps = tostring(EnumOps),\n KvOps = tostring(KvOps),\n Resources = tostring(Resources),\n TimeGenerated=FirstEnum,\n Caller=CallerNorm,\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", CallerIp, \"/overview\")\n| project TimeGenerated, Caller, CallerIp, XDRIPUrl,\n KvCount, EnumCount,\n FirstEnum, LastEnum,\n FirstKv, LastKv,\n EnumOps, KvOps,\n Resources, SubscriptionId\n| where isempty('{UserFilter}') or Caller contains '{UserFilter}'\n| where isempty('{IPFilter}') or CallerIp contains '{IPFilter}'\n| order by KvCount desc, FirstKv desc\n| limit 25", "size": 0, "title": "IAM and subscription enumeration followed by Key Vault operations", "noDataMessage": "βœ… No IAM/subscription enumeration followed by Key Vault operations in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "KvCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "EnumCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "20", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "5", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstEnum", "formatter": 6 }, { "columnMatch": "LastEnum", "formatter": 6 }, { "columnMatch": "FirstKv", "formatter": 6 }, { "columnMatch": "LastKv", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Recon Started" }, { "columnId": "Caller", "label": "Identity" }, { "columnId": "CallerIp", "label": "Caller IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "KvCount", "label": "Key Vault Ops" }, { "columnId": "EnumCount", "label": "Recon Ops" }, { "columnId": "FirstEnum", "label": "First Recon" }, { "columnId": "LastEnum", "label": "Last Recon" }, { "columnId": "FirstKv", "label": "First KV" }, { "columnId": "LastKv", "label": "Last KV" }, { "columnId": "EnumOps", "label": "Recon Operations" }, { "columnId": "KvOps", "label": "Key Vault Operations" }, { "columnId": "Resources", "label": "KV Resources" }, { "columnId": "SubscriptionId", "label": "Subscription" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "dc-d1-iam-enum-kv", "id": "a81a5556-d6f6-4896-ad1a-b5d9c54f63d0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet DiscoveryOps =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationNameValue has_any (\n \"microsoft.authorization/roleassignments/read\",\n \"microsoft.authorization/roledefinitions/read\",\n \"microsoft.resources/subscriptions/read\",\n \"microsoft.resources/subscriptions/resourcegroups/read\",\n \"microsoft.resources/subscriptions/resourcegroups/resources/read\",\n \"microsoft.resources/subscriptions/providers/read\"\n )\n | where isnotempty(CallerIpAddress)\n | extend CallerNorm = tolower(Caller)\n | project EnumTime=TimeGenerated, CallerNorm, CallerIpAddress, EnumOperation=OperationNameValue, SubscriptionId;\nlet BaselineNISignin =\n AADNonInteractiveUserSignInLogs\n | where TimeGenerated between ((StartTime - 14d) .. StartTime)\n | where ResultType in~ (\"0\", \"Success\")\n | where isnotempty(Identity) and isnotempty(IPAddress)\n | extend IdentityNorm = tolower(Identity), AppIdNorm = tolower(AppId), SrcIp = tostring(IPAddress), Ua = tostring(UserAgent)\n | summarize by IdentityNorm, AppIdNorm, SrcIp, Ua;\nlet CurrentNovelNISignin =\n AADNonInteractiveUserSignInLogs\n | where TimeGenerated between (StartTime .. EndTime)\n | where ResultType in~ (\"0\", \"Success\")\n | where isnotempty(Identity) and isnotempty(IPAddress)\n | extend IdentityNorm = tolower(Identity), AppIdNorm = tolower(AppId), SrcIp = tostring(IPAddress), Ua = tostring(UserAgent)\n | join kind=leftanti BaselineNISignin on IdentityNorm, AppIdNorm, SrcIp, Ua\n | project SigninTime=TimeGenerated, Identity, IdentityNorm, AppId, IPAddress=SrcIp, UserAgent=Ua, CorrelationId, ResultType, ConditionalAccessStatus;\nCurrentNovelNISignin\n| join kind=inner DiscoveryOps on $left.IPAddress == $right.CallerIpAddress\n| where SigninTime between (EnumTime .. (EnumTime + 2h))\n| extend MinutesToSignin = datetime_diff('minute', SigninTime, EnumTime),\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", IPAddress, \"/overview\")\n| project TimeGenerated=EnumTime, MinutesToSignin, Identity, IPAddress, XDRIPUrl, AppId,\n ConditionalAccessStatus, EnumOperation, SigninTime,\n ResultType, UserAgent, CorrelationId,\n Caller=CallerNorm, SubscriptionId\n| where isempty('{UserFilter}') or Identity contains '{UserFilter}'\n| where isempty('{IPFilter}') or IPAddress contains '{IPFilter}'\n| order by MinutesToSignin asc\n| limit 25", "size": 0, "title": "Identity and app enumeration followed by novel non-interactive tuple", "noDataMessage": "βœ… No identity/app enumeration followed by novel non-interactive sign-ins in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "MinutesToSignin", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1} min" }, { "operator": "<", "thresholdValue": "30", "representation": "orange", "text": "⚠️ {0}{1} min" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1} min" } ] } }, { "columnMatch": "ConditionalAccessStatus", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "notApplied", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": "==", "thresholdValue": "failure", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "SigninTime", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Recon Time" }, { "columnId": "MinutesToSignin", "label": "Mins to Sign-in" }, { "columnId": "Identity", "label": "Identity" }, { "columnId": "IPAddress", "label": "IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "AppId", "label": "App Id" }, { "columnId": "EntraAppUrl", "label": "App" }, { "columnId": "ConditionalAccessStatus", "label": "CA Status" }, { "columnId": "EnumOperation", "label": "Recon Op" }, { "columnId": "SigninTime", "label": "Sign-in Time" }, { "columnId": "ResultType", "label": "Result" }, { "columnId": "UserAgent", "label": "User Agent" }, { "columnId": "CorrelationId", "label": "Correlation Id" }, { "columnId": "Caller", "label": "Recon Caller" }, { "columnId": "SubscriptionId", "label": "Subscription" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "dc-d2-identity-enum-ni-signin", "id": "000a5369-a0f0-4256-afb6-8a30277e62a7" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet KeyVaultDiscovery =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationNameValue has \"microsoft.keyvault/vaults/\" and OperationNameValue has_any (\"/read\", \"/list\", \"accesspolicies\")\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(Caller), CallerIp = tostring(CallerIpAddress)\n | summarize FirstKv=min(TimeGenerated), LastKv=max(TimeGenerated), KvOps=make_set(OperationNameValue, 20), KvCount=count()\n by CallerNorm, CallerIp, SubscriptionId;\nlet DataStoreRecon =\n AzureActivity\n | where TimeGenerated between (StartTime .. EndTime)\n | where OperationNameValue has_any (\n \"microsoft.storage/storageaccounts/\",\n \"microsoft.sql/servers/databases/\",\n \"microsoft.documentdb/databaseaccounts/\",\n \"microsoft.kusto/clusters/\",\n \"listkeys/action\"\n )\n and OperationNameValue has_any (\"/read\", \"/list\", \"listkeys/action\", \"/query\")\n | where isnotempty(Caller)\n | extend CallerNorm = tolower(Caller), CallerIp = tostring(CallerIpAddress)\n | summarize FirstData=min(TimeGenerated), LastData=max(TimeGenerated), DataOps=make_set(OperationNameValue, 30),\n DataResources=make_set(ResourceId, 30), DataCount=count()\n by CallerNorm, CallerIp, SubscriptionId;\nKeyVaultDiscovery\n| join kind=inner DataStoreRecon on CallerNorm, SubscriptionId\n| where FirstData between (FirstKv .. (LastKv + 2h))\n| extend KvOps = tostring(KvOps),\n DataOps = tostring(DataOps),\n DataResources = tostring(DataResources),\n MinutesToData = datetime_diff('minute', FirstData, FirstKv),\n XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", CallerIp, \"/overview\")\n| project TimeGenerated=FirstKv, DataCount, KvCount, MinutesToData,\n Caller=CallerNorm, CallerIp, XDRIPUrl,\n FirstKv, LastKv,\n FirstData, LastData,\n KvOps, DataOps,\n DataResources, SubscriptionId\n| where isempty('{UserFilter}') or Caller contains '{UserFilter}'\n| where isempty('{IPFilter}') or CallerIp contains '{IPFilter}'\n| order by DataCount desc, MinutesToData asc\n| limit 25", "size": 0, "title": "Key Vault discovery followed by data-store access enumeration", "noDataMessage": "βœ… No Key Vault discovery followed by data-store enumeration in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "DataCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "KvCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "MinutesToData", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "<", "thresholdValue": "30", "representation": "redBright", "text": "🚨 {0}{1} min" }, { "operator": "<", "thresholdValue": "120", "representation": "orange", "text": "⚠️ {0}{1} min" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1} min" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstKv", "formatter": 6 }, { "columnMatch": "LastKv", "formatter": 6 }, { "columnMatch": "FirstData", "formatter": 6 }, { "columnMatch": "LastData", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "KV Discovery Started" }, { "columnId": "DataCount", "label": "Data-Store Ops" }, { "columnId": "KvCount", "label": "Key Vault Ops" }, { "columnId": "MinutesToData", "label": "Mins to Data Pivot" }, { "columnId": "Caller", "label": "Identity" }, { "columnId": "CallerIp", "label": "Caller IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "FirstKv", "label": "First KV" }, { "columnId": "LastKv", "label": "Last KV" }, { "columnId": "FirstData", "label": "First Data" }, { "columnId": "LastData", "label": "Last Data" }, { "columnId": "KvOps", "label": "Key Vault Operations" }, { "columnId": "DataOps", "label": "Data-Store Operations" }, { "columnId": "DataResources", "label": "Data Resources" }, { "columnId": "SubscriptionId", "label": "Subscription" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "dc-d3-kv-datastore-enum", "id": "19943b34-20f4-4e33-9c17-1f206b45b847" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet ConsentChanges =\n _Im_AuditEvent(starttime=StartTime,endtime=EndTime)\n | where TimeGenerated between (StartTime .. EndTime)\n | extend OperationText = tostring(coalesce(Operation, EventType, EventMessage)),\n OperationName = tostring(Operation),\n InitiatorUpn = tostring(ActorUsername),\n InitiatorIp = tostring(SrcIpAddr),\n InitiatorApp = tostring(ActingAppName),\n CorrelationId = tostring(column_ifexists(\"CorrelationId\", \"\"))\n | where OperationText has_any (\"consent\", \"permission grant\", \"app role\", \"application\")\n | project ChangeTime=TimeGenerated, ActivityDisplayName=OperationText, OperationName, CorrelationId, InitiatorUpn, InitiatorIp, InitiatorApp;\nlet HistoricalOAuthApps =\n CloudAppEvents\n | where TimeGenerated between ((StartTime - 14d) .. StartTime)\n | where isnotempty(OAuthAppId)\n | project OAuthAppId\n | summarize by OAuthAppId;\nlet FirstSeenOAuthBursts =\n CloudAppEvents\n | where TimeGenerated between (StartTime .. EndTime)\n | where isnotempty(OAuthAppId)\n | project TimeGenerated, OAuthAppId, Application, IPAddress, AccountId\n | join kind=leftanti HistoricalOAuthApps on OAuthAppId\n | summarize FirstActivity=min(TimeGenerated), LastActivity=max(TimeGenerated), EventCount=count(),\n DistinctUsers=dcount(AccountId), DistinctIPs=dcount(IPAddress),\n Users=make_set(AccountId, 20), SrcIps=make_set(IPAddress, 20)\n by OAuthAppId, Application, IPAddress\n | where EventCount >= 5;\nConsentChanges\n| join kind=inner FirstSeenOAuthBursts on $left.InitiatorIp == $right.IPAddress\n| where FirstActivity between (ChangeTime .. (ChangeTime + 24h))\n| project TimeGenerated=ChangeTime, FirstActivity, LastActivity, ActivityDisplayName, OperationName, CorrelationId,\n InitiatorUpn, InitiatorIp, InitiatorApp, OAuthAppId, Application, EventCount, DistinctUsers, DistinctIPs, Users, SrcIps\n| where isempty('{UserFilter}') or InitiatorUpn contains '{UserFilter}'\n| where isempty('{IPFilter}') or InitiatorIp contains '{IPFilter}'\n| summarize Count=count() by Application\n| top 10 by Count\n| render barchart", "size": 0, "title": "Top 10 Bursting Apps by Event Count", "noDataMessage": "βœ… No first-seen OAuth app bursts following consent changes in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "xAxis": "Application", "yAxis": [ "Count" ], "createOtherGroup": null } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "dc-d4-oauth-consent-burst", "id": "250b031a-1fcf-4b6f-a49c-b1afdc11a030" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet ConsentChanges =\n _Im_AuditEvent(starttime=StartTime,endtime=EndTime)\n | where TimeGenerated between (StartTime .. EndTime)\n | extend OperationText = tostring(coalesce(Operation, EventType, EventMessage)),\n OperationName = tostring(Operation),\n InitiatorUpn = tostring(ActorUsername),\n InitiatorIp = tostring(SrcIpAddr),\n InitiatorApp = tostring(ActingAppName),\n CorrelationId = tostring(column_ifexists(\"CorrelationId\", \"\"))\n | where OperationText has_any (\"consent\", \"permission grant\", \"app role\", \"application\")\n | project ChangeTime=TimeGenerated, ActivityDisplayName=OperationText, OperationName, CorrelationId, InitiatorUpn, InitiatorIp, InitiatorApp;\nlet HistoricalOAuthApps =\n CloudAppEvents\n | where TimeGenerated between ((StartTime - 14d) .. StartTime)\n | where isnotempty(OAuthAppId)\n | project OAuthAppId\n | summarize by OAuthAppId;\nlet FirstSeenOAuthBursts =\n CloudAppEvents\n | where TimeGenerated between (StartTime .. EndTime)\n | where isnotempty(OAuthAppId)\n | project TimeGenerated, OAuthAppId, Application, IPAddress, AccountId\n | join kind=leftanti HistoricalOAuthApps on OAuthAppId\n | summarize FirstActivity=min(TimeGenerated), LastActivity=max(TimeGenerated), EventCount=count(),\n DistinctUsers=dcount(AccountId), DistinctIPs=dcount(IPAddress),\n Users=make_set(AccountId, 20), SrcIps=make_set(IPAddress, 20)\n by OAuthAppId, Application, IPAddress\n | where EventCount >= 5;\nConsentChanges\n| join kind=inner FirstSeenOAuthBursts on $left.InitiatorIp == $right.IPAddress\n| where FirstActivity between (ChangeTime .. (ChangeTime + 24h))\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", InitiatorIp, \"/overview\")\n| project TimeGenerated=ChangeTime, EventCount, DistinctUsers, DistinctIPs,\n InitiatorUpn, InitiatorIp, XDRIPUrl, Application, OAuthAppId,\n FirstActivity, LastActivity, ActivityDisplayName, OperationName, InitiatorApp, CorrelationId, Users, SrcIps\n| where isempty('{UserFilter}') or InitiatorUpn contains '{UserFilter}'\n| where isempty('{IPFilter}') or InitiatorIp contains '{IPFilter}'\n| order by EventCount desc, TimeGenerated desc\n| limit 25", "size": 0, "title": "OAuth consent change followed by first-seen OAuthAppId burst", "noDataMessage": "βœ… No consent changes correlated with first-seen OAuth app bursts in this window.", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "EventCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "20", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "10", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "DistinctUsers", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "DistinctIPs", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstActivity", "formatter": 6 }, { "columnMatch": "LastActivity", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Consent Change Time" }, { "columnId": "EventCount", "label": "App Burst Events" }, { "columnId": "DistinctUsers", "label": "Distinct Users" }, { "columnId": "DistinctIPs", "label": "Distinct IPs" }, { "columnId": "InitiatorUpn", "label": "Initiator" }, { "columnId": "InitiatorIp", "label": "Initiator IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "Application", "label": "OAuth App" }, { "columnId": "OAuthAppId", "label": "OAuth App Id" }, { "columnId": "EntraAppUrl", "label": "App" }, { "columnId": "FirstActivity", "label": "First App Activity" }, { "columnId": "LastActivity", "label": "Last App Activity" }, { "columnId": "ActivityDisplayName", "label": "Consent Activity" }, { "columnId": "OperationName", "label": "Operation" }, { "columnId": "InitiatorApp", "label": "Via App" }, { "columnId": "CorrelationId", "label": "Correlation Id" }, { "columnId": "Users", "label": "Users" }, { "columnId": "SrcIps", "label": "Source IPs" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "dc-d4-oauth-consent-burst-detail", "id": "da66753e-35a1-4fed-95bc-23f7b533a13f" } ] }, "conditionalVisibility": { "parameterName": "isDiscoveryVisible", "comparison": "isEqualTo", "value": "true" }, "name": "section-6-Discovery", "id": "4b85a7e8-033f-47f1-b02f-8d69644644b4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## 🟠 Lateral Movement\nOn-prem ↔ cloud identity pivoting: Kerberoast bursts preceding cloud sign-in, AAD Connect/sync-host remote admin into Entra privilege operations, RDP to hybrid-joined devices then Entra access, cloud sign-in to on-prem RDP/remote-exec, and WMI/PsExec on hybrid devices then cloud sign-in.\n\n**MITRE:** T1558.003 Β· T1021.001 Β· T1047 Β· T1569.002 Β· T1098 Β· T1078.004 \n**Key tables:** IdentityInfo Β· DeviceInfo Β· _Im_Authentication Β· _Im_ProcessEvent Β· _Im_AuditEvent" }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "name": "section-3-text", "id": "f6e10a1d-e1bd-4e01-8b06-f770cd357fd8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\n let BaselineStart = StartTime - 14d;\n let BaselineEnd = EndTime + 1d;\n// Build latest hybrid identity keys for reliable cross-source correlation.\nlet HybridUsersRaw =\n IdentityInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | extend _OnPremDN = column_ifexists(\"OnPremisesDistinguishedName\", column_ifexists(\"DistinguishedName\", \"\"))\n | where isnotempty(_OnPremDN) and isnotempty(AccountObjectId)\n | project TimeGenerated, AccountObjectId, AccountUPN, AccountDomain, AccountName, BlastRadius\n | summarize arg_max(TimeGenerated, *) by AccountObjectId\n | extend UPNKey = tolower(AccountUPN),\n SamKey = tolower(strcat(AccountDomain, \"\\\\\", AccountName)),\n NameKey = tolower(AccountName);\n// Normalize multiple account key formats into one joinable user key.\nlet HybridUsers =\n union isfuzzy=true\n (HybridUsersRaw | where isnotempty(UPNKey) | project UserKey = UPNKey, HybridUPN = UPNKey, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius, AccountObjectId),\n (HybridUsersRaw | where isnotempty(SamKey) | project UserKey = SamKey, HybridUPN = UPNKey, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius, AccountObjectId),\n (HybridUsersRaw | where isnotempty(NameKey) | project UserKey = NameKey, HybridUPN = UPNKey, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius, AccountObjectId);\n// Detect potential Kerberoast behavior as a burst of Kerberos service ticket-like auth events.\n let KerberoastBurst =\n SecurityEvent\n | where TimeGenerated between (StartTime .. EndTime)\n | where EventID == 4769\n // Extract TicketEncryptionType from EventData XML\n | extend TicketEncryptionType = tolower(tostring(extract(@'([^<]+)', 1, tostring(column_ifexists(\"EventData\", \"\")))))\n | where TicketEncryptionType has_any (\"0x17\", \"17\")\n | extend Requestor = tolower(tostring(coalesce(Account, TargetUserName))),\n Service = tolower(tostring(ServiceName)),\n ClientIP = tostring(IpAddress)\n | where isnotempty(Requestor) and isnotempty(Service)\n | where Requestor !endswith \"$\" and Service !endswith \"$\"\n | summarize FirstKerberoast = min(TimeGenerated),\n LastKerberoast = max(TimeGenerated),\n DistinctServices = dcount(Service),\n KerberoastEvents = count(),\n ServiceSet = make_set(Service, 25),\n SourceIPs = make_set(ClientIP, 10)\n by Requestor\n | where DistinctServices >= 8;\n// Collect successful cloud sign-ins for the same identities.\nlet CloudUserSignins =\n _Im_Authentication(starttime=StartTime, endtime=(EndTime + 1d))\n | where EventResult in~ (\"Success\", \"Partial\")\n | where EventProduct =~ \"Microsoft Entra ID\"\n | where LogonProtocol has_any (\"OAuth\", \"OpenID\", \"SAML\")\n or LogonMethod in~ (\"Service Principal\", \"Managed Identity\", \"Username & Password\", \"Multi factor authentication\", \"Passwordless\", \"PKI\")\n | extend UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n CloudIP = tostring(SrcIpAddr),\n AppName = tostring(TargetAppName),\n ClientApp = tostring(ActingAppName)\n | where isnotempty(UserKey)\n | project SigninTime = TimeGenerated, UserKey, CloudIP, AppName, ClientApp, CorrelationId = EventOriginalUid;\n// Correlate on-prem Kerberoast burst to near-term cloud sign-in activity.\nKerberoastBurst\n| join kind=innerunique HybridUsers on $left.Requestor == $right.UserKey\n| join kind=inner CloudUserSignins on UserKey\n| where SigninTime between (LastKerberoast .. (LastKerberoast + 6h))\n| summarize FirstCloudSignin = min(SigninTime),\n LastCloudSignin = max(SigninTime),\n CloudSigninCount = count(),\n DistinctCloudIPs = dcount(CloudIP),\n CloudIPs = make_set(CloudIP, 15),\n Apps = make_set(AppName, 10),\n ClientApps = make_set(ClientApp, 10),\n CorrelationIds = make_set(CorrelationId, 10),\n ServiceSet = take_any(ServiceSet),\n SourceIPs = take_any(SourceIPs)\n by FirstKerberoast, LastKerberoast, KerberoastEvents, DistinctServices,\n HybridUPN, HybridSam, BlastRadius,\n AccountObjectId\n| extend TimeGenerated = FirstKerberoast\n| where isempty('{UserFilter}') or HybridUPN contains '{UserFilter}'\n| where isempty('{IPFilter}') or tostring(SourceIPs) contains '{IPFilter}'\n| summarize Count=count() by BlastRadius\n| render barchart", "size": 0, "title": "Kerberoast burst followed by cloud sign-in", "noDataMessage": "βœ… No kerberoast β†’ cloud sign-in chains in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "barchart", "chartSettings": { "xAxis": "BlastRadius", "yAxis": [ "Count" ], "showDataLabels": true, "createOtherGroup": null } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "lm-l1-kerberoast-cloud-signin", "id": "55abdc70-340a-4d0c-80e0-1ea1b302d462" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\n let BaselineStart = StartTime - 14d;\n let BaselineEnd = EndTime + 1d;\n// Build latest hybrid identity keys for reliable cross-source correlation.\nlet HybridUsersRaw =\n IdentityInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | extend _OnPremDN = column_ifexists(\"OnPremisesDistinguishedName\", column_ifexists(\"DistinguishedName\", \"\"))\n | where isnotempty(_OnPremDN) and isnotempty(AccountObjectId)\n | project TimeGenerated, AccountObjectId, AccountUPN, AccountDomain, AccountName, BlastRadius\n | summarize arg_max(TimeGenerated, *) by AccountObjectId\n | extend UPNKey = tolower(AccountUPN),\n SamKey = tolower(strcat(AccountDomain, \"\\\\\", AccountName)),\n NameKey = tolower(AccountName);\n// Normalize multiple account key formats into one joinable user key.\nlet HybridUsers =\n union isfuzzy=true\n (HybridUsersRaw | where isnotempty(UPNKey) | project UserKey = UPNKey, HybridUPN = UPNKey, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius, AccountObjectId),\n (HybridUsersRaw | where isnotempty(SamKey) | project UserKey = SamKey, HybridUPN = UPNKey, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius, AccountObjectId),\n (HybridUsersRaw | where isnotempty(NameKey) | project UserKey = NameKey, HybridUPN = UPNKey, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius, AccountObjectId);\n// Detect potential Kerberoast behavior as a burst of Kerberos service ticket-like auth events.\n let KerberoastBurst =\n SecurityEvent\n | where TimeGenerated between (StartTime .. EndTime)\n | where EventID == 4769\n // Extract TicketEncryptionType from EventData XML\n | extend TicketEncryptionType = tolower(tostring(extract(@'([^<]+)', 1, tostring(column_ifexists(\"EventData\", \"\")))))\n | where TicketEncryptionType has_any (\"0x17\", \"17\")\n | extend Requestor = tolower(tostring(coalesce(Account, TargetUserName))),\n Service = tolower(tostring(ServiceName)),\n ClientIP = tostring(IpAddress)\n | where isnotempty(Requestor) and isnotempty(Service)\n | where Requestor !endswith \"$\" and Service !endswith \"$\"\n | summarize FirstKerberoast = min(TimeGenerated),\n LastKerberoast = max(TimeGenerated),\n DistinctServices = dcount(Service),\n KerberoastEvents = count(),\n ServiceSet = make_set(Service, 25),\n SourceIPs = make_set(ClientIP, 10)\n by Requestor\n | where DistinctServices >= 8;\n// Collect successful cloud sign-ins for the same identities.\nlet CloudUserSignins =\n _Im_Authentication(starttime=StartTime, endtime=(EndTime + 1d))\n | where EventResult in~ (\"Success\", \"Partial\")\n | where EventProduct =~ \"Microsoft Entra ID\"\n | where LogonProtocol has_any (\"OAuth\", \"OpenID\", \"SAML\")\n or LogonMethod in~ (\"Service Principal\", \"Managed Identity\", \"Username & Password\", \"Multi factor authentication\", \"Passwordless\", \"PKI\")\n | extend UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n CloudIP = tostring(SrcIpAddr),\n AppName = tostring(TargetAppName),\n ClientApp = tostring(ActingAppName)\n | where isnotempty(UserKey)\n | project SigninTime = TimeGenerated, UserKey, CloudIP, AppName, ClientApp, CorrelationId = EventOriginalUid;\n// Correlate on-prem Kerberoast burst to near-term cloud sign-in activity.\nKerberoastBurst\n| join kind=innerunique HybridUsers on $left.Requestor == $right.UserKey\n| join kind=inner CloudUserSignins on UserKey\n| where SigninTime between (LastKerberoast .. (LastKerberoast + 6h))\n| summarize FirstCloudSignin = min(SigninTime),\n LastCloudSignin = max(SigninTime),\n CloudSigninCount = count(),\n DistinctCloudIPs = dcount(CloudIP),\n CloudIPs = make_set(CloudIP, 15),\n Apps = make_set(AppName, 10),\n ClientApps = make_set(ClientApp, 10),\n CorrelationIds = make_set(CorrelationId, 10),\n ServiceSet = take_any(ServiceSet),\n SourceIPs = take_any(SourceIPs)\n by FirstKerberoast, LastKerberoast, KerberoastEvents, DistinctServices,\n HybridUPN, HybridSam, BlastRadius,\n AccountObjectId\n| extend TimeGenerated = FirstKerberoast\n| where isempty('{UserFilter}') or HybridUPN contains '{UserFilter}'\n| where isempty('{IPFilter}') or tostring(SourceIPs) contains '{IPFilter}'\n| order by TimeGenerated desc\n| limit 25", "size": 0, "title": "Kerberoast burst followed by cloud sign-in - Detailed", "noDataMessage": "βœ… No kerberoast β†’ cloud sign-in chains in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "BlastRadius", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "DistinctServices", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "15", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "8", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "KerberoastEvents", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "50", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "10", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "CloudSigninCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstKerberoast", "formatter": 6 }, { "columnMatch": "LastKerberoast", "formatter": 6 }, { "columnMatch": "FirstCloudSignin", "formatter": 6 }, { "columnMatch": "LastCloudSignin", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Kerberoast Start" }, { "columnId": "BlastRadius", "label": "Blast Radius" }, { "columnId": "CriticalityLevel", "label": "Criticality" }, { "columnId": "HybridUPN", "label": "Hybrid Identity" }, { "columnId": "HybridSam", "label": "SAM Account" }, { "columnId": "KerberoastEvents", "label": "Kerberos Events" }, { "columnId": "DistinctServices", "label": "Distinct Services" }, { "columnId": "ServiceSet", "label": "Services (sample)" }, { "columnId": "SourceIPs", "label": "On-Prem Source IPs" }, { "columnId": "FirstKerberoast", "label": "First Kerberoast" }, { "columnId": "LastKerberoast", "label": "Last Kerberoast" }, { "columnId": "FirstCloudSignin", "label": "First Cloud Sign-in" }, { "columnId": "LastCloudSignin", "label": "Last Cloud Sign-in" }, { "columnId": "CloudSigninCount", "label": "Cloud Sign-ins" }, { "columnId": "DistinctCloudIPs", "label": "Distinct Cloud IPs" }, { "columnId": "CloudIPs", "label": "Cloud IPs" }, { "columnId": "Apps", "label": "Apps" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "lm-l1-kerberoast-cloud-signin-detail", "id": "3e1b8413-a0ca-42cb-afc5-b17f74219dbb" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineStart = StartTime - 14d;\nlet BaselineEnd = EndTime + 1d;\n// Process and operation lists used to detect sync-host admin and privileged cloud ops.\nlet SyncProcesses = dynamic([\"miiserver.exe\", \"azureadconnectwizard.exe\", \"azureadconnect.exe\", \"directorysyncclientcmd.exe\", \"aadconnectprovisioningagent.exe\", \"azureadconnecthealthsyncmonitor.exe\"]);\nlet RemoteParents = dynamic([\"wmiprvse.exe\", \"wsmprovhost.exe\", \"psexesvc.exe\", \"winrs.exe\"]);\nlet PrivilegedOps = dynamic([\"Add member to role\", \"Add app role assignment to service principal\", \"Add service principal credentials\", \"Update application\", \"Update service principal\", \"Certificates and secrets management\", \"Add owner\", \"Add member to group\", \"Consent to application\"]);\n// Build latest hybrid identity keys for correlation.\nlet HybridUsersRaw =\n IdentityInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | extend _OnPremDN = column_ifexists(\"OnPremisesDistinguishedName\", column_ifexists(\"DistinguishedName\", \"\"))\n | where isnotempty(_OnPremDN) and isnotempty(AccountObjectId)\n | project TimeGenerated, AccountObjectId, AccountUPN, AccountDomain, AccountName, BlastRadius\n | summarize arg_max(TimeGenerated, *) by AccountObjectId\n | extend UPNKey = tolower(AccountUPN),\n SamKey = tolower(strcat(AccountDomain, \"\\\\\", AccountName)),\n NameKey = tolower(AccountName);\n// Normalize key variants into one join key.\nlet HybridUsers =\n union isfuzzy=true\n (HybridUsersRaw | where isnotempty(UPNKey) | project UserKey = UPNKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius),\n (HybridUsersRaw | where isnotempty(SamKey) | project UserKey = SamKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius),\n (HybridUsersRaw | where isnotempty(NameKey) | project UserKey = NameKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius);\n// Identify likely Entra Connect/sync hosts from process telemetry.\n let SyncHosts =\n _Im_ProcessEvent(starttime=BaselineStart, endtime=BaselineEnd)\n | where EventType =~ \"ProcessCreated\"\n | extend ProcessName = tolower(coalesce(TargetProcessFilename, TargetProcessFileOriginalName)),\n ParentProcess = tolower(coalesce(ActingProcessFilename, ActingProcessFileOriginalName)),\n DeviceJoinKey = tolower(coalesce(DvcId, DvcHostname))\n | where ProcessName in~ (SyncProcesses) or ParentProcess in~ (SyncProcesses)\n | where isnotempty(DeviceJoinKey)\n | summarize arg_max(TimeGenerated, DvcHostname) by DeviceJoinKey\n | project DeviceJoinKey, SyncHostName = DvcHostname;\n// Collect remote administration activity (RDP and remote execution).\nlet RemoteAdmin =\n union isfuzzy=true\n (\n _Im_Authentication(starttime=StartTime,endtime=EndTime)\n | where EventResult in~ (\"Success\", \"Partial\")\n | where EventSubType =~ \"RemoteInteractive\"\n | extend UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n DeviceJoinKey = tolower(coalesce(TargetDvcId, DvcId, TargetFQDN, DvcHostname)),\n SourceIP = tostring(SrcIpAddr),\n ActivityType = \"RDP\"\n | where isnotempty(UserKey)\n | where isnotempty(DeviceJoinKey)\n | project ActivityTime = TimeGenerated, DeviceJoinKey, UserKey, SourceIP, ActivityType, Evidence = tostring(coalesce(EventSubType, LogonMethod, LogonProtocol))\n ),\n (\n _Im_ProcessEvent(starttime=StartTime,endtime=EndTime)\n | where TimeGenerated between (StartTime .. EndTime)\n | extend ParentProcess = tolower(coalesce(ActingProcessName, ActingProcessFilename, ActingProcessFileOriginalName)),\n ParentOriginal = tolower(ActingProcessFileOriginalName),\n ChildCommandLine = tostring(TargetProcessCommandLine),\n UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n DeviceJoinKey = tolower(coalesce(DvcId, DvcHostname)),\n SourceIP = tostring(DvcIpAddr),\n ActivityType = \"RemoteExec\"\n | where ParentProcess in~ (RemoteParents) or ParentOriginal in~ (RemoteParents)\n | where isnotempty(UserKey)\n | where isnotempty(DeviceJoinKey)\n | project ActivityTime = TimeGenerated, DeviceJoinKey, UserKey, SourceIP, ActivityType, Evidence = ChildCommandLine\n );\n// Gather high-risk Entra audit activity performed by identities.\nlet EntraPrivOps =\n _Im_AuditEvent(starttime=StartTime,endtime=EndTime)\n | where TimeGenerated between (StartTime .. (EndTime + 1d))\n | extend ActorKey = tolower(ActorUsername),\n ActorIP = tostring(SrcIpAddr),\n OperationText = strcat(tostring(EventType), \" \", tostring(EventMessage), \" \", tostring(TargetAppName))\n | where isnotempty(ActorKey)\n | where EventResult in~ (\"Success\", \"Partial\")\n | where OperationText has_any (PrivilegedOps)\n | project AuditTime = TimeGenerated, ActorKey, ActorIP, OperationText;\n// Correlate sync-host remote admin to near-term privileged Entra operations.\nRemoteAdmin\n| join kind=inner SyncHosts on DeviceJoinKey\n| join kind=innerunique HybridUsers on UserKey\n| join kind=inner EntraPrivOps on $left.UserKey == $right.ActorKey\n| where AuditTime between (ActivityTime .. (ActivityTime + 4h))\n| summarize FirstPrivilegedOp = min(AuditTime),\n LastPrivilegedOp = max(AuditTime),\n PrivilegedOpCount = count(),\n ActorIPs = make_set(ActorIP, 10),\n Operations = make_set(OperationText, 15)\n by ActivityTime, SyncHostName, ActivityType, SourceIP,\n HybridUPN, HybridSam, BlastRadius, Evidence\n| extend Confidence = iff(BlastRadius == \"High\", \"High\", \"Medium\")\n| extend TimeGenerated = ActivityTime\n| where isempty('{UserFilter}') or HybridUPN contains '{UserFilter}'\n| where isempty('{IPFilter}') or SourceIP contains '{IPFilter}'\n| where isempty('{DeviceFilter}') or SyncHostName contains '{DeviceFilter}'\n| order by TimeGenerated desc\n| project-away ActivityTime\n| limit 25", "size": 0, "title": "AAD Connect host remote admin followed by Entra privilege operation", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "noDataMessage": "βœ… No AAD Connect host admin β†’ Entra privilege-op chains in this window.", "showExportToExcel": true, "gridSettings": { "formatters": [ { "columnMatch": "Confidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "BlastRadius", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "PrivilegedOpCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstPrivilegedOp", "formatter": 6 }, { "columnMatch": "LastPrivilegedOp", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Remote Admin Time" }, { "columnId": "SyncHostName", "label": "Sync Host" }, { "columnId": "ActivityType", "label": "Access Type" }, { "columnId": "SourceIP", "label": "Source IP" }, { "columnId": "HybridUPN", "label": "Hybrid Identity" }, { "columnId": "HybridSam", "label": "SAM Account" }, { "columnId": "BlastRadius", "label": "Blast Radius" }, { "columnId": "CriticalityLevel", "label": "Criticality" }, { "columnId": "Evidence", "label": "Evidence" }, { "columnId": "FirstPrivilegedOp", "label": "First Priv Op" }, { "columnId": "LastPrivilegedOp", "label": "Last Priv Op" }, { "columnId": "PrivilegedOpCount", "label": "Priv Op Count" }, { "columnId": "ActorIPs", "label": "Cloud Actor IPs" }, { "columnId": "Operations", "label": "Privileged Operations" }, { "columnId": "Confidence", "label": "Confidence" } ] } }, "customWidth": "50", "name": "lm-l2-aadconnect-entra-priv", "id": "4f73afd9-be99-4ab8-9321-3f252c16b133" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineStart = StartTime - 14d;\nlet BaselineEnd = EndTime + 1d;\nlet HybridUsersRaw =\n IdentityInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | extend _OnPremDN = column_ifexists(\"OnPremisesDistinguishedName\", column_ifexists(\"DistinguishedName\", \"\"))\n | where isnotempty(_OnPremDN) and isnotempty(AccountObjectId)\n | project TimeGenerated, AccountObjectId, AccountUPN, AccountDomain, AccountName, BlastRadius\n | summarize arg_max(TimeGenerated, *) by AccountObjectId\n | extend UPNKey = tolower(AccountUPN),\n SamKey = tolower(strcat(AccountDomain, \"\\\\\", AccountName)),\n NameKey = tolower(AccountName);\nlet HybridUsers =\n union isfuzzy=true\n (HybridUsersRaw | where isnotempty(UPNKey) | project UserKey = UPNKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius),\n (HybridUsersRaw | where isnotempty(SamKey) | project UserKey = SamKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius),\n (HybridUsersRaw | where isnotempty(NameKey) | project UserKey = NameKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius);\nlet HybridDevicesRaw =\n DeviceInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | project TimeGenerated, DeviceId, DeviceName, JoinType, AadDeviceId, IsAzureADJoined\n | summarize arg_max(TimeGenerated, *) by DeviceId\n | where IsAzureADJoined == true or tostring(JoinType) has_any (\"Hybrid\", \"Azure AD\", \"Entra\")\n | project DeviceId, HybridDeviceName = DeviceName, JoinType, AadDeviceId, IsAzureADJoined;\nlet HybridDevices =\n union isfuzzy=true\n (HybridDevicesRaw | where isnotempty(DeviceId) | project DeviceJoinKey = tolower(DeviceId), HybridDeviceName, JoinType, AadDeviceId, IsAzureADJoined),\n (HybridDevicesRaw | where isnotempty(HybridDeviceName) | project DeviceJoinKey = tolower(HybridDeviceName), HybridDeviceName, JoinType, AadDeviceId, IsAzureADJoined);\nlet RdpSessions =\n _Im_Authentication(starttime=StartTime, endtime=EndTime)\n | where EventResult in~ (\"Success\", \"Partial\")\n | where EventSubType =~ \"RemoteInteractive\"\n | extend UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n DeviceJoinKey = tolower(coalesce(TargetDvcId, DvcId, TargetFQDN, DvcHostname)),\n SourceIP = tostring(SrcIpAddr),\n InitiatorUPN = tostring(ActorUsername)\n | where isnotempty(UserKey)\n | where isnotempty(DeviceJoinKey)\n | project RdpTime = TimeGenerated, DeviceJoinKey, UserKey, SourceIP, IsLocalAdmin = false, InitiatorUPN;\nlet CloudUserSignins =\n _Im_Authentication(starttime=StartTime, endtime=(EndTime + 1d))\n | where EventResult in~ (\"Success\", \"Partial\")\n | where ActorScope has \"Azure\" or TargetUserScope has \"Azure\" or EventProduct has_any (\"Azure AD\", \"Entra\", \"AAD\")\n | where EventSubType has_any (\"Service\", \"RemoteService\", \"AssumeRole\")\n or LogonMethod has_any (\"OAuth\", \"Token\", \"NonInteractive\")\n or LogonProtocol has_any (\"OAuth\", \"OpenID\", \"SAML\")\n | extend UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n CloudIP = tostring(SrcIpAddr),\n AppName = tostring(TargetAppName),\n ClientApp = tostring(ActingAppName)\n | where isnotempty(UserKey)\n | project SigninTime = TimeGenerated, UserKey, CloudIP, AppName, ClientApp, ConditionalAccessStatus = \"\", CorrelationId = EventOriginalUid;\nRdpSessions\n| join kind=inner HybridDevices on DeviceJoinKey\n| join kind=innerunique HybridUsers on UserKey\n| join kind=inner CloudUserSignins on UserKey\n| where SigninTime between (RdpTime .. (RdpTime + 2h))\n| summarize FirstCloudSignin = min(SigninTime),\n LastCloudSignin = max(SigninTime),\n CloudSigninCount = count(),\n Apps = make_set(AppName, 10),\n ClientApps = make_set(ClientApp, 10),\n CloudIPs = make_set(CloudIP, 10),\n CorrelationIds = make_set(CorrelationId, 10)\n by RdpTime, HybridDeviceName, JoinType, SourceIP, IsLocalAdmin,\n HybridUPN, HybridSam, BlastRadius, InitiatorUPN\n| extend Confidence = iff(IsLocalAdmin == true or BlastRadius == \"High\", \"High\", \"Medium\")\n| extend TimeGenerated = RdpTime\n| where isempty('{UserFilter}') or HybridUPN contains '{UserFilter}'\n| where isempty('{DeviceFilter}') or HybridDeviceName contains '{DeviceFilter}'\n| where isempty('{IPFilter}') or SourceIP contains '{IPFilter}'\n| order by TimeGenerated desc\n| project-away RdpTime, IsLocalAdmin\n| limit 25", "size": 0, "title": "RDP to hybrid joined device followed by Entra access", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "noDataMessage": "βœ… No RDP β†’ cloud access chains on hybrid devices in this window.", "showExportToExcel": true, "gridSettings": { "formatters": [ { "columnMatch": "Confidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "BlastRadius", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "CloudSigninCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstCloudSignin", "formatter": 6 }, { "columnMatch": "LastCloudSignin", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "RDP Time" }, { "columnId": "HybridDeviceName", "label": "Hybrid Device" }, { "columnId": "JoinType", "label": "Join Type" }, { "columnId": "SourceIP", "label": "Source IP" }, { "columnId": "HybridUPN", "label": "Hybrid Identity" }, { "columnId": "HybridSam", "label": "SAM Account" }, { "columnId": "BlastRadius", "label": "Blast Radius" }, { "columnId": "CriticalityLevel", "label": "Criticality" }, { "columnId": "InitiatorUPN", "label": "Initiator UPN" }, { "columnId": "FirstCloudSignin", "label": "First Cloud Sign-in" }, { "columnId": "LastCloudSignin", "label": "Last Cloud Sign-in" }, { "columnId": "CloudSigninCount", "label": "Cloud Sign-ins" }, { "columnId": "Apps", "label": "Apps" }, { "columnId": "ClientApps", "label": "Client Apps" }, { "columnId": "CloudIPs", "label": "Cloud IPs" }, { "columnId": "Confidence", "label": "Confidence" } ] } }, "customWidth": "50", "name": "lm-l5-rdp-hybrid-entra", "id": "b42f1ee9-c16d-4454-9bec-4f30960168ab" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineStart = StartTime - 14d;\nlet BaselineEnd = EndTime + 1d;\n// Parent/child process lists used to identify remote execution behavior.\nlet RemoteParents = dynamic([\"wmiprvse.exe\", \"wsmprovhost.exe\", \"psexesvc.exe\", \"winrs.exe\"]);\nlet SuspiciousChildren = dynamic([\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"net.exe\", \"net1.exe\", \"whoami.exe\", \"nltest.exe\", \"reg.exe\", \"certutil.exe\", \"rundll32.exe\", \"mshta.exe\"]);\n// Build latest hybrid identity keys to unify cloud and endpoint telemetry.\nlet HybridUsersRaw =\n IdentityInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | extend _OnPremDN = column_ifexists(\"OnPremisesDistinguishedName\", column_ifexists(\"DistinguishedName\", \"\"))\n | where isnotempty(_OnPremDN) and isnotempty(AccountObjectId)\n | project TimeGenerated, AccountObjectId, AccountUPN, AccountDomain, AccountName, BlastRadius\n | summarize arg_max(TimeGenerated, *) by AccountObjectId\n | extend UPNKey = tolower(AccountUPN),\n SamKey = tolower(strcat(AccountDomain, \"\\\\\", AccountName)),\n NameKey = tolower(AccountName);\n// Normalize user key variants into one joinable identity key.\nlet HybridUsers =\n union isfuzzy=true\n (HybridUsersRaw | where isnotempty(UPNKey) | project UserKey = UPNKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius),\n (HybridUsersRaw | where isnotempty(SamKey) | project UserKey = SamKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius),\n (HybridUsersRaw | where isnotempty(NameKey) | project UserKey = NameKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius);\n// Keep latest hybrid or Entra-joined devices as on-prem movement targets.\nlet HybridDevicesRaw =\n DeviceInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | project TimeGenerated, DeviceId, DeviceName, JoinType, IsAzureADJoined\n | summarize arg_max(TimeGenerated, *) by DeviceId\n | where IsAzureADJoined == true or tostring(JoinType) has_any (\"Hybrid\", \"Azure AD\", \"Entra\")\n | project DeviceId, HybridDeviceName = DeviceName, JoinType;\nlet HybridDevices =\n union isfuzzy=true\n (HybridDevicesRaw | where isnotempty(DeviceId) | project DeviceJoinKey = tolower(DeviceId), HybridDeviceName, JoinType),\n (HybridDevicesRaw | where isnotempty(HybridDeviceName) | project DeviceJoinKey = tolower(HybridDeviceName), HybridDeviceName, JoinType);\n// Capture successful cloud sign-ins by hybrid identities.\nlet CloudUserSignins =\n _Im_Authentication(starttime=StartTime, endtime=EndTime)\n | where EventResult in~ (\"Success\", \"Partial\")\n | where ActorScope has \"Azure\" or TargetUserScope has \"Azure\" or EventProduct has_any (\"Azure AD\", \"Entra\", \"AAD\")\n | where EventSubType has_any (\"Service\", \"RemoteService\", \"AssumeRole\")\n or LogonMethod has_any (\"OAuth\", \"Token\", \"NonInteractive\")\n or LogonProtocol has_any (\"OAuth\", \"OpenID\", \"SAML\")\n | extend UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n CloudIP = tostring(SrcIpAddr),\n AppName = tostring(TargetAppName),\n ClientApp = tostring(ActingAppName)\n | where isnotempty(UserKey)\n | project SigninTime = TimeGenerated, UserKey, CloudIP, AppName, ClientApp, CorrelationId = EventOriginalUid;\n// Capture on-prem lateral movement candidates (RDP and remote execution).\nlet OnPremMovement =\n union isfuzzy=true\n (\n _Im_Authentication(starttime=StartTime, endtime=(EndTime + 1d))\n | where EventResult in~ (\"Success\", \"Partial\")\n | where EventSubType =~ \"RemoteInteractive\"\n | extend UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n DeviceJoinKey = tolower(coalesce(TargetDvcId, DvcId, TargetFQDN, DvcHostname)),\n SourceIP = tostring(SrcIpAddr),\n Evidence = tostring(coalesce(EventSubType, LogonMethod, LogonProtocol)),\n MovementType = \"RDP\"\n | where isnotempty(UserKey)\n | where isnotempty(DeviceJoinKey)\n | project MovementTime = TimeGenerated, DeviceJoinKey, UserKey, SourceIP, MovementType, Evidence\n ),\n (\n _Im_ProcessEvent(starttime=StartTime, endtime=(EndTime + 1d))\n | where EventType =~ \"ProcessCreated\"\n | extend ChildProcess = tolower(coalesce(TargetProcessFilename, TargetProcessFileOriginalName)),\n ChildCommandLine = tostring(TargetProcessCommandLine)\n | extend ParentProcess = tolower(coalesce(ActingProcessName, ActingProcessFilename, ActingProcessFileOriginalName)),\n ParentOriginal = tolower(ActingProcessFileOriginalName),\n UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n DeviceJoinKey = tolower(coalesce(DvcId, DvcHostname)),\n SourceIP = tostring(coalesce(tostring(AdditionalFields[\"RemoteIP\"]), DvcIpAddr)),\n Evidence = strcat(ChildProcess, \" \", ChildCommandLine),\n MovementType = \"RemoteExec\"\n | where ParentProcess in~ (RemoteParents) or ParentOriginal in~ (RemoteParents)\n | where ChildProcess in~ (SuspiciousChildren)\n or ChildCommandLine has_any (\" -enc \", \" /node:\", \" -computername \", \"invoke-command\", \"win32_process\", \"create \")\n | where isnotempty(UserKey)\n | where isnotempty(DeviceJoinKey)\n | project MovementTime = TimeGenerated, DeviceJoinKey, UserKey, SourceIP, MovementType, Evidence\n );\n// Correlate cloud sign-in to near-term on-prem movement by the same identity.\nCloudUserSignins\n| join kind=innerunique HybridUsers on UserKey\n| join kind=inner OnPremMovement on UserKey\n| join kind=inner HybridDevices on DeviceJoinKey\n| where MovementTime between (SigninTime .. (SigninTime + 4h))\n| where isempty('{UserFilter}') or HybridUPN contains '{UserFilter}'\n| where isempty('{DeviceFilter}') or HybridDeviceName contains '{DeviceFilter}'\n| summarize FirstMovement = min(MovementTime),\n LastMovement = max(MovementTime),\n MovementCount = count(),\n Devices = make_set(HybridDeviceName, 10),\n SourceIPs = make_set(SourceIP, 10),\n EvidenceSet = make_set(Evidence, 15),\n Apps = make_set(AppName, 10),\n ClientApps = make_set(ClientApp, 10)\n by SigninTime, CloudIP, HybridUPN, HybridSam, BlastRadius, MovementType\n| extend Confidence = iff(BlastRadius == \"High\" or MovementCount >= 2, \"High\", \"Medium\")\n| extend TimeGenerated = SigninTime\n| where isempty('{IPFilter}') or tostring(SourceIPs) contains '{IPFilter}'\n| order by TimeGenerated desc\n| project-away SigninTime\n| limit 25", "size": 0, "title": "Entra hybrid user sign-in followed by on-prem lateral movement", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "noDataMessage": "βœ… No cloud sign-in β†’ on-prem movement chains in this window.", "showExportToExcel": true, "gridSettings": { "formatters": [ { "columnMatch": "Confidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "BlastRadius", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "MovementCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "2", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstMovement", "formatter": 6 }, { "columnMatch": "LastMovement", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Cloud Sign-in Time" }, { "columnId": "CloudIP", "label": "Cloud IP" }, { "columnId": "HybridUPN", "label": "Hybrid Identity" }, { "columnId": "HybridSam", "label": "SAM Account" }, { "columnId": "BlastRadius", "label": "Blast Radius" }, { "columnId": "CriticalityLevel", "label": "Criticality" }, { "columnId": "MovementType", "label": "Movement Type" }, { "columnId": "FirstMovement", "label": "First Movement" }, { "columnId": "LastMovement", "label": "Last Movement" }, { "columnId": "MovementCount", "label": "Movement Count" }, { "columnId": "Devices", "label": "Target Devices" }, { "columnId": "SourceIPs", "label": "On-Prem Source IPs" }, { "columnId": "EvidenceSet", "label": "Evidence" }, { "columnId": "Apps", "label": "Cloud Apps" }, { "columnId": "ClientApps", "label": "Client Apps" }, { "columnId": "Confidence", "label": "Confidence" } ] } }, "customWidth": "50", "name": "lm-l6-entra-hybrid-onprem-lm", "id": "305d56c1-30ed-4411-a6e6-6378cae54c31" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet BaselineStart = StartTime - 14d;\nlet BaselineEnd = EndTime + 1d;\nlet RemoteParents = dynamic([\"wmiprvse.exe\", \"wsmprovhost.exe\", \"psexesvc.exe\", \"winrs.exe\"]);\nlet SuspiciousChildren = dynamic([\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"net.exe\", \"net1.exe\", \"whoami.exe\", \"nltest.exe\", \"reg.exe\", \"certutil.exe\", \"rundll32.exe\", \"mshta.exe\"]);\nlet HybridUsersRaw =\n IdentityInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | extend _OnPremDN = column_ifexists(\"OnPremisesDistinguishedName\", column_ifexists(\"DistinguishedName\", \"\"))\n | where isnotempty(_OnPremDN) and isnotempty(AccountObjectId)\n | project TimeGenerated, AccountObjectId, AccountUPN, AccountDomain, AccountName, BlastRadius\n | summarize arg_max(TimeGenerated, *) by AccountObjectId\n | extend UPNKey = tolower(AccountUPN),\n SamKey = tolower(strcat(AccountDomain, \"\\\\\", AccountName)),\n NameKey = tolower(AccountName);\nlet HybridUsers =\n union isfuzzy=true\n (HybridUsersRaw | where isnotempty(UPNKey) | project UserKey = UPNKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius),\n (HybridUsersRaw | where isnotempty(SamKey) | project UserKey = SamKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius),\n (HybridUsersRaw | where isnotempty(NameKey) | project UserKey = NameKey, HybridUPN = AccountUPN, HybridSam = strcat(AccountDomain, \"\\\\\", AccountName), BlastRadius);\nlet HybridDevicesRaw =\n DeviceInfo\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | project TimeGenerated, DeviceId, DeviceName, JoinType, IsAzureADJoined\n | summarize arg_max(TimeGenerated, *) by DeviceId\n | where IsAzureADJoined == true or tostring(JoinType) has_any (\"Hybrid\", \"Azure AD\", \"Entra\")\n | project DeviceId, HybridDeviceName = DeviceName, JoinType;\nlet HybridDevices =\n union isfuzzy=true\n (HybridDevicesRaw | where isnotempty(DeviceId) | project DeviceJoinKey = tolower(DeviceId), HybridDeviceName, JoinType),\n (HybridDevicesRaw | where isnotempty(HybridDeviceName) | project DeviceJoinKey = tolower(HybridDeviceName), HybridDeviceName, JoinType);\nlet RemoteExec =\n _Im_ProcessEvent(starttime=StartTime, endtime=EndTime)\n | where EventType =~ \"ProcessCreated\"\n | extend ParentProcess = tolower(coalesce(ActingProcessName, ActingProcessFilename, ActingProcessFileOriginalName)),\n ParentOriginal = tolower(ActingProcessFileOriginalName),\n ChildProcess = tolower(TargetProcessName),\n ChildCommandLine = tostring(TargetProcessCommandLine),\n UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n DeviceJoinKey = tolower(coalesce(DvcId, DvcHostname)),\n SourceIP = DvcIpAddr\n | where ParentProcess in~ (RemoteParents) or ParentOriginal in~ (RemoteParents)\n | where ChildProcess in~ (SuspiciousChildren)\n or ChildCommandLine has_any (\" -enc \", \"sekurlsa\", \"lsass\", \" /node:\", \" -computername \", \"invoke-command\", \"win32_process\", \"create \")\n | where isnotempty(UserKey)\n | where isnotempty(DeviceJoinKey)\n | project ExecTime = TimeGenerated, DeviceJoinKey, UserKey, SourceIP,\n ParentProcess, ChildProcess, ChildCommandLine;\nlet CloudUserSignins =\n _Im_Authentication(starttime=StartTime, endtime=(EndTime + 1d))\n | where EventResult in~ (\"Success\", \"Partial\")\n | where ActorScope has \"Azure\" or TargetUserScope has \"Azure\" or EventProduct has_any (\"Azure AD\", \"Entra\", \"AAD\")\n | where EventSubType has_any (\"Service\", \"RemoteService\", \"AssumeRole\")\n or LogonMethod has_any (\"OAuth\", \"Token\", \"NonInteractive\")\n or LogonProtocol has_any (\"OAuth\", \"OpenID\", \"SAML\")\n | extend UserKey = tolower(coalesce(ActorUsername, TargetUsername)),\n CloudIP = tostring(SrcIpAddr),\n AppName = tostring(TargetAppName)\n | where isnotempty(UserKey)\n | project SigninTime = TimeGenerated, UserKey, CloudIP, AppName, CorrelationId = EventOriginalUid;\nRemoteExec\n| join kind=inner HybridDevices on DeviceJoinKey\n| join kind=innerunique HybridUsers on UserKey\n| join kind=inner CloudUserSignins on UserKey\n| where SigninTime between (ExecTime .. (ExecTime + 2h))\n| where isempty('{UserFilter}') or HybridUPN contains '{UserFilter}'\n| where isempty('{DeviceFilter}') or HybridDeviceName contains '{DeviceFilter}'\n| where isempty('{IPFilter}') or SourceIP contains '{IPFilter}'\n| summarize FirstCloudSignin = min(SigninTime),\n LastCloudSignin = max(SigninTime),\n CloudSigninCount = count(),\n Apps = make_set(AppName, 10),\n CloudIPs = make_set(CloudIP, 10),\n CorrelationIds = make_set(CorrelationId, 10)\n by ExecTime, HybridDeviceName, JoinType, SourceIP, ParentProcess,\n ChildProcess, ChildCommandLine, HybridUPN, HybridSam,\n BlastRadius\n| extend Confidence = iff(BlastRadius == \"High\", \"High\", \"Medium\")\n| extend TimeGenerated = ExecTime\n| order by TimeGenerated desc\n| project-away ExecTime\n| limit 25", "size": 0, "title": "WMI or remote admin execution on hybrid device followed by cloud sign-in", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "noDataMessage": "βœ… No remote-exec β†’ cloud sign-in chains on hybrid devices in this window.", "showExportToExcel": true, "gridSettings": { "formatters": [ { "columnMatch": "Confidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "BlastRadius", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "CloudSigninCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "10", "representation": "redBright", "text": "{0}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "{0}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}" } ] } }, { "columnMatch": "TimeGenerated", "formatter": 6 }, { "columnMatch": "FirstCloudSignin", "formatter": 6 }, { "columnMatch": "LastCloudSignin", "formatter": 6 } ], "labelSettings": [ { "columnId": "TimeGenerated", "label": "Exec Time" }, { "columnId": "HybridDeviceName", "label": "Hybrid Device" }, { "columnId": "JoinType", "label": "Join Type" }, { "columnId": "SourceIP", "label": "Source IP" }, { "columnId": "ParentProcess", "label": "Parent Process" }, { "columnId": "ChildProcess", "label": "Child Process" }, { "columnId": "ChildCommandLine", "label": "Command Line" }, { "columnId": "HybridUPN", "label": "Hybrid Identity" }, { "columnId": "HybridSam", "label": "SAM Account" }, { "columnId": "BlastRadius", "label": "Blast Radius" }, { "columnId": "CriticalityLevel", "label": "Criticality" }, { "columnId": "FirstCloudSignin", "label": "First Cloud Sign-in" }, { "columnId": "LastCloudSignin", "label": "Last Cloud Sign-in" }, { "columnId": "CloudSigninCount", "label": "Cloud Sign-ins" }, { "columnId": "Apps", "label": "Cloud Apps" }, { "columnId": "CloudIPs", "label": "Cloud IPs" }, { "columnId": "Confidence", "label": "Confidence" } ] } }, "customWidth": "50", "name": "lm-l7-wmi-hybrid-cloud-signin", "id": "201daec7-fbcd-4ab1-9490-943b043686e9" } ] }, "conditionalVisibility": { "parameterName": "isLateralMovementVisible", "comparison": "isEqualTo", "value": "true" }, "name": "section-7-LateralMovement", "id": "bab6b1a3-7f8d-478f-a1ed-64d38cbabe5e" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## πŸ“€ Exfiltration\nBulk storage download and first-seen-IP access via AccountKey/SAS, multi-mailbox access from a single IP via cloud-app permissions, external email-forwarding rules, and OAuth app consents granting sensitive permissions.\n\n**MITRE:** T1530 Β· T1020 Β· T1537 Β· T1567 Β· T1020.001 Β· T1528 Β· T1098.001 Β· T1078.004 \n**Key tables:** StorageBlobLogs Β· CloudAppEvents Β· AuditLogs Β· ThreatIntelIndicators" }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "name": "section-9-header", "id": "f65c970b-df56-432b-a72a-95e321b8861c" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet opsThreshold = 100;\nlet bytesThreshold = 104857600;\nlet knownBackupAgents = dynamic([\n \"Microsoft BITS\", \"CVLT\", \"SQLBLOBACCESS\",\n \"WA-Storage\", \"AzureStorage/CopyEngine\",\n \"Veeam\", \"Komprise\", \"Nasuni\", \"Cohesity\", \"HYCU\", \"Panzura\"]);\nlet knownExfilTools = dynamic([\n \"rclone\", \"s3cmd\", \"gsutil\", \"aws-cli\",\n \"MinIO\", \"wget\", \"curl\", \"aria2\", \"FileZilla\"]);\nlet browserAgents = dynamic([\n \"Mozilla\", \"Chrome\", \"Safari\",\n \"Firefox\", \"Edge\", \"Edg/\"]);\nStorageBlobLogs\n| where TimeGenerated between (StartTime .. EndTime)\n| where AuthenticationType in (\"AccountKey\", \"SAS\", \"DSas\")\n| where OperationName in (\n \"GetBlob\", \"ListBlobs\",\n \"ListContainersSegment\", \"ListBlobsHierarchySegment\")\n| where StatusCode in (200, 206)\n| where isnotempty(CallerIpAddress)\n| where not (CallerIpAddress startswith \"10.\"\n or CallerIpAddress startswith \"192.168.\"\n or (CallerIpAddress startswith \"172.\"\n and toint(split(CallerIpAddress, \".\")[1]) between (16 .. 31))\n or CallerIpAddress startswith \"169.254.\"\n or CallerIpAddress startswith \"127.\")\n| where not (UserAgentHeader has_any (knownBackupAgents)\n or UserAgentHeader contains \"rubrik\")\n| extend\n IsExfilTool = UserAgentHeader has_any (knownExfilTools),\n IsBrowserAgent = UserAgentHeader has_any (browserAgents),\n IsEmptyAgent = isempty(UserAgentHeader),\n IsAccountKey = AuthenticationType == \"AccountKey\"\n| summarize\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n TotalOperations = count(),\n TotalBytesDownloaded = sum(tolong(ResponseBodySize)),\n DistinctContainers = dcount(tostring(split(Uri, \"/\")[3])),\n DistinctBlobs = dcount(Uri),\n AuthTypes = make_set(AuthenticationType),\n StorageAccounts = make_set(AccountName),\n UserAgents = make_set(UserAgentHeader),\n IsExfilTool = max(IsExfilTool),\n IsBrowserAgent = max(IsBrowserAgent),\n IsEmptyAgent = max(IsEmptyAgent),\n IsAccountKey = max(IsAccountKey)\n by CallerIpAddress\n| where TotalOperations >= opsThreshold\n or TotalBytesDownloaded >= bytesThreshold\n| extend RiskScore =\n toint(IsAccountKey)\n + toint(IsExfilTool)\n + toint(IsBrowserAgent and TotalBytesDownloaded > 104857600)\n + toint(TotalBytesDownloaded > 1073741824)\n| extend RiskFactors = set_difference(pack_array(\n iff(IsAccountKey, \"AccountKey auth\", \"\"),\n iff(IsExfilTool, \"Known exfil tool\", \"\"),\n iff(IsBrowserAgent and TotalBytesDownloaded > 104857600, \"Browser + large DL\", \"\"),\n iff(TotalBytesDownloaded > 1073741824, \">1GB downloaded\", \"\")\n ), dynamic([\"\"]))\n| where RiskScore >= 1\n| extend TotalBytesGB = round(TotalBytesDownloaded / 1073741824.0, 2)\n | project-reorder\n FirstSeen, LastSeen, CallerIpAddress,\n RiskScore, RiskFactors,\n TotalOperations, TotalBytesGB,\n DistinctContainers, DistinctBlobs,\n AuthTypes, StorageAccounts, UserAgents\n | where isempty('{IPFilter}') or CallerIpAddress contains '{IPFilter}'\n| order by RiskScore desc, TotalBytesGB desc\n| extend RiskBand = case(RiskScore >= 4, \"4 - Critical\", RiskScore == 3, \"3 - High\", RiskScore == 2, \"2 - Medium\", RiskScore == 1, \"1 - Low\", \"0 - Informational\")\n| summarize Count=count() by RiskBand\n| sort by RiskBand asc\n| render barchart", "size": 0, "title": "Storage Bulk Download via AccountKey/SAS from External IP (by RiskScore)", "noDataMessage": "βœ… No external bulk-download activity scored in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "xAxis": "RiskBand", "yAxis": [ "Count" ], "showDataLabels": true, "createOtherGroup": null } }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ex-e1-storage-bulk-download", "id": "abaff2a0-1355-4ae4-9680-a44c79bf25e3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet opsThreshold = 100;\nlet bytesThreshold = 104857600;\nlet knownBackupAgents = dynamic([\n \"Microsoft BITS\", \"CVLT\", \"SQLBLOBACCESS\",\n \"WA-Storage\", \"AzureStorage/CopyEngine\",\n \"Veeam\", \"Komprise\", \"Nasuni\", \"Cohesity\", \"HYCU\", \"Panzura\"]);\nlet knownExfilTools = dynamic([\n \"rclone\", \"s3cmd\", \"gsutil\", \"aws-cli\",\n \"MinIO\", \"wget\", \"curl\", \"aria2\", \"FileZilla\"]);\nlet browserAgents = dynamic([\n \"Mozilla\", \"Chrome\", \"Safari\",\n \"Firefox\", \"Edge\", \"Edg/\"]);\nStorageBlobLogs\n| where TimeGenerated between (StartTime .. EndTime)\n| where AuthenticationType in (\"AccountKey\", \"SAS\", \"DSas\")\n| where OperationName in (\n \"GetBlob\", \"ListBlobs\",\n \"ListContainersSegment\", \"ListBlobsHierarchySegment\")\n| where StatusCode in (200, 206)\n| where isnotempty(CallerIpAddress)\n| where not (CallerIpAddress startswith \"10.\"\n or CallerIpAddress startswith \"192.168.\"\n or (CallerIpAddress startswith \"172.\"\n and toint(split(CallerIpAddress, \".\")[1]) between (16 .. 31))\n or CallerIpAddress startswith \"169.254.\"\n or CallerIpAddress startswith \"127.\")\n| where not (UserAgentHeader has_any (knownBackupAgents)\n or UserAgentHeader contains \"rubrik\")\n| extend\n IsExfilTool = UserAgentHeader has_any (knownExfilTools),\n IsBrowserAgent = UserAgentHeader has_any (browserAgents),\n IsEmptyAgent = isempty(UserAgentHeader),\n IsAccountKey = AuthenticationType == \"AccountKey\"\n| summarize\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n TotalOperations = count(),\n TotalBytesDownloaded = sum(tolong(ResponseBodySize)),\n DistinctContainers = dcount(tostring(split(Uri, \"/\")[3])),\n DistinctBlobs = dcount(Uri),\n AuthTypes = make_set(AuthenticationType),\n StorageAccounts = make_set(AccountName),\n UserAgents = make_set(UserAgentHeader),\n IsExfilTool = max(IsExfilTool),\n IsBrowserAgent = max(IsBrowserAgent),\n IsEmptyAgent = max(IsEmptyAgent),\n IsAccountKey = max(IsAccountKey)\n by CallerIpAddress\n| where TotalOperations >= opsThreshold\n or TotalBytesDownloaded >= bytesThreshold\n| extend RiskScore =\n toint(IsAccountKey)\n + toint(IsExfilTool)\n + toint(IsBrowserAgent and TotalBytesDownloaded > 104857600)\n + toint(TotalBytesDownloaded > 1073741824)\n| extend RiskFactors = set_difference(pack_array(\n iff(IsAccountKey, \"AccountKey auth\", \"\"),\n iff(IsExfilTool, \"Known exfil tool\", \"\"),\n iff(IsBrowserAgent and TotalBytesDownloaded > 104857600, \"Browser + large DL\", \"\"),\n iff(TotalBytesDownloaded > 1073741824, \">1GB downloaded\", \"\")\n ), dynamic([\"\"]))\n| where RiskScore >= 1\n| extend TotalBytesGB = round(TotalBytesDownloaded / 1073741824.0, 2)\n | project-reorder\n FirstSeen, LastSeen, CallerIpAddress,\n RiskScore, RiskFactors,\n TotalOperations, TotalBytesGB,\n DistinctContainers, DistinctBlobs,\n AuthTypes, StorageAccounts, UserAgents\n | where isempty('{IPFilter}') or CallerIpAddress contains '{IPFilter}'\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", CallerIpAddress, \"/overview\")\n| order by RiskScore desc, TotalBytesGB desc\n| limit 25", "size": 0, "title": "Storage Bulk Download via AccountKey/SAS from External IP - Detailed", "noDataMessage": "βœ… No external bulk-download activity in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "RiskScore", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "4", "representation": "redBright", "text": "🚨 {0} - Critical" }, { "operator": "==", "thresholdValue": "3", "representation": "redBright", "text": "πŸ”΄ {0} - High" }, { "operator": "==", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0} - Medium" }, { "operator": "==", "thresholdValue": "1", "representation": "yellow", "text": "🟑 {0} - Low" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "🟒 {0} - Informational" } ] } }, { "columnMatch": "TotalBytesGB", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "1", "representation": "redBright", "text": "🚨 {0} GB" }, { "operator": ">=", "thresholdValue": "0.1", "representation": "orange", "text": "⚠️ {0} GB" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0} GB" } ] } }, { "columnMatch": "TotalOperations", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "1000", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "100", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "FirstSeen", "formatter": 6 }, { "columnMatch": "LastSeen", "formatter": 6 } ], "labelSettings": [ { "columnId": "CallerIpAddress", "label": "Source IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "RiskScore", "label": "Risk (0-4)" }, { "columnId": "RiskFactors", "label": "Risk Factors" }, { "columnId": "TotalOperations", "label": "Operations" }, { "columnId": "TotalBytesGB", "label": "Downloaded (GB)" }, { "columnId": "DistinctContainers", "label": "Containers" }, { "columnId": "DistinctBlobs", "label": "Blobs" }, { "columnId": "AuthTypes", "label": "Auth Types" }, { "columnId": "StorageAccounts", "label": "Storage Accounts" }, { "columnId": "UserAgents", "label": "User Agents" }, { "columnId": "FirstSeen", "label": "First Seen" }, { "columnId": "LastSeen", "label": "Last Seen" } ] } }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ex-e1-storage-bulk-download-detail", "id": "4115fae4-d7eb-4b91-a333-ebc44253d1bc" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let BaselineStart = StartTime - 14d;\n let BaselineEnd = StartTime;\nlet opsThreshold = 10;\nlet bytesThreshold = 10485760;\nlet riskyAuthTypes = dynamic([\"AccountKey\", \"SAS\", \"DSas\"]);\nlet knownBackupAgents = dynamic([\n \"Microsoft BITS\", \"CVLT\", \"SQLBLOBACCESS\",\n \"WA-Storage\", \"AzureStorage/CopyEngine\",\n \"Veeam\", \"Komprise\", \"Nasuni\", \"Cohesity\", \"HYCU\", \"Panzura\"]);\nlet knownIPs =\n StorageBlobLogs\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | where AuthenticationType in (riskyAuthTypes)\n | where StatusCode in (200, 206)\n | where isnotempty(CallerIpAddress)\n | where not (CallerIpAddress startswith \"10.\"\n or CallerIpAddress startswith \"192.168.\"\n or (CallerIpAddress startswith \"172.\"\n and toint(split(CallerIpAddress, \".\")[1]) between (16 .. 31))\n or CallerIpAddress startswith \"169.254.\"\n or CallerIpAddress startswith \"127.\")\n | distinct CallerIpAddress, AccountName;\nStorageBlobLogs\n| where TimeGenerated between (StartTime .. EndTime)\n| where AuthenticationType in (riskyAuthTypes)\n| where OperationName in (\n \"GetBlob\", \"ListBlobs\",\n \"ListContainersSegment\", \"ListBlobsHierarchySegment\")\n| where StatusCode in (200, 206)\n| where isnotempty(CallerIpAddress)\n| where not (CallerIpAddress startswith \"10.\"\n or CallerIpAddress startswith \"192.168.\"\n or (CallerIpAddress startswith \"172.\"\n and toint(split(CallerIpAddress, \".\")[1]) between (16 .. 31))\n or CallerIpAddress startswith \"169.254.\"\n or CallerIpAddress startswith \"127.\")\n| where not (UserAgentHeader has_any (knownBackupAgents)\n or UserAgentHeader contains \"rubrik\")\n| join kind=leftanti knownIPs on CallerIpAddress, AccountName\n| summarize\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n TotalOperations = count(),\n TotalBytesDownloaded = sum(tolong(ResponseBodySize)),\n DistinctBlobs = dcount(Uri),\n AuthTypes = make_set(AuthenticationType),\n UserAgents = make_set(UserAgentHeader)\n by CallerIpAddress, AccountName\n| where TotalOperations >= opsThreshold\n or TotalBytesDownloaded >= bytesThreshold\n| extend TotalBytesGB = round(TotalBytesDownloaded / 1073741824.0, 2)\n | project-reorder\n FirstSeen, LastSeen,\n CallerIpAddress, AccountName,\n TotalOperations, TotalBytesGB, DistinctBlobs,\n AuthTypes, UserAgents\n | where isempty('{IPFilter}') or CallerIpAddress contains '{IPFilter}'\n| where isempty('{UserFilter}') or AccountName contains '{UserFilter}'\n| order by TotalBytesGB desc\n| summarize Count=count() by AccountName\n| top 10 by Count\n| render barchart", "size": 0, "title": "Storage Access from First-Seen External IP via AccountKey/SAS (by AccountName)", "noDataMessage": "βœ… No first-seen external-IP storage access in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "xAxis": "AccountName", "yAxis": [ "Count" ], "showDataLabels": true, "createOtherGroup": null } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ex-e2-storage-firstseen-ip", "id": "f563c1f5-d4ae-427e-a21b-df60c2d0e006" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\n let BaselineStart = StartTime - 14d;\n let BaselineEnd = StartTime;\nlet opsThreshold = 10;\nlet bytesThreshold = 10485760;\nlet riskyAuthTypes = dynamic([\"AccountKey\", \"SAS\", \"DSas\"]);\nlet knownBackupAgents = dynamic([\n \"Microsoft BITS\", \"CVLT\", \"SQLBLOBACCESS\",\n \"WA-Storage\", \"AzureStorage/CopyEngine\",\n \"Veeam\", \"Komprise\", \"Nasuni\", \"Cohesity\", \"HYCU\", \"Panzura\"]);\nlet knownIPs =\n StorageBlobLogs\n | where TimeGenerated between (BaselineStart .. BaselineEnd)\n | where AuthenticationType in (riskyAuthTypes)\n | where StatusCode in (200, 206)\n | where isnotempty(CallerIpAddress)\n | where not (CallerIpAddress startswith \"10.\"\n or CallerIpAddress startswith \"192.168.\"\n or (CallerIpAddress startswith \"172.\"\n and toint(split(CallerIpAddress, \".\")[1]) between (16 .. 31))\n or CallerIpAddress startswith \"169.254.\"\n or CallerIpAddress startswith \"127.\")\n | distinct CallerIpAddress, AccountName;\nStorageBlobLogs\n| where TimeGenerated between (StartTime .. EndTime)\n| where AuthenticationType in (riskyAuthTypes)\n| where OperationName in (\n \"GetBlob\", \"ListBlobs\",\n \"ListContainersSegment\", \"ListBlobsHierarchySegment\")\n| where StatusCode in (200, 206)\n| where isnotempty(CallerIpAddress)\n| where not (CallerIpAddress startswith \"10.\"\n or CallerIpAddress startswith \"192.168.\"\n or (CallerIpAddress startswith \"172.\"\n and toint(split(CallerIpAddress, \".\")[1]) between (16 .. 31))\n or CallerIpAddress startswith \"169.254.\"\n or CallerIpAddress startswith \"127.\")\n| where not (UserAgentHeader has_any (knownBackupAgents)\n or UserAgentHeader contains \"rubrik\")\n| join kind=leftanti knownIPs on CallerIpAddress, AccountName\n| summarize\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n TotalOperations = count(),\n TotalBytesDownloaded = sum(tolong(ResponseBodySize)),\n DistinctBlobs = dcount(Uri),\n AuthTypes = make_set(AuthenticationType),\n UserAgents = make_set(UserAgentHeader)\n by CallerIpAddress, AccountName\n| where TotalOperations >= opsThreshold\n or TotalBytesDownloaded >= bytesThreshold\n| extend TotalBytesGB = round(TotalBytesDownloaded / 1073741824.0, 2)\n | project-reorder\n FirstSeen, LastSeen,\n CallerIpAddress, AccountName,\n TotalOperations, TotalBytesGB, DistinctBlobs,\n AuthTypes, UserAgents\n | where isempty('{IPFilter}') or CallerIpAddress contains '{IPFilter}'\n| where isempty('{UserFilter}') or AccountName contains '{UserFilter}'\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", CallerIpAddress, \"/overview\")\n| order by TotalBytesGB desc\n| limit 25", "size": 0, "title": "Storage Access from First-Seen External IP via AccountKey/SAS - Detailed", "noDataMessage": "βœ… No first-seen external-IP storage access in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "TotalBytesGB", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "1", "representation": "redBright", "text": "🚨 {0} GB" }, { "operator": ">=", "thresholdValue": "0.1", "representation": "orange", "text": "⚠️ {0} GB" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0} GB" } ] } }, { "columnMatch": "TotalOperations", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "1000", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "100", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "DistinctBlobs", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "100", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "10", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "FirstSeen", "formatter": 6 }, { "columnMatch": "LastSeen", "formatter": 6 } ], "labelSettings": [ { "columnId": "CallerIpAddress", "label": "Source IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "AccountName", "label": "Storage Account" }, { "columnId": "TotalOperations", "label": "Operations" }, { "columnId": "TotalBytesGB", "label": "Downloaded (GB)" }, { "columnId": "DistinctBlobs", "label": "Blobs" }, { "columnId": "AuthTypes", "label": "Auth Types" }, { "columnId": "UserAgents", "label": "User Agents" }, { "columnId": "FirstSeen", "label": "First Seen" }, { "columnId": "LastSeen", "label": "Last Seen" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ex-e2-storage-firstseen-ip-detail", "id": "d00a5bde-28ad-42ae-88ff-e159fe369116" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\nlet distinctMailboxThreshold = 10;\nlet minMailAccessCount = 100;\nCloudAppEvents\n| where TimeGenerated between (StartTime .. EndTime)\n| where ActionType == \"MailItemsAccessed\"\n| extend AccessedMailbox = tostring(RawEventData.UserId)\n| extend ClientIP = tostring(RawEventData.ClientIP)\n| extend UserAgent = tostring(RawEventData.UserAgent)\n| where isnotempty(AccessedMailbox) and isnotempty(ClientIP)\n| summarize\n FirstAccess = min(TimeGenerated),\n LastAccess = max(TimeGenerated),\n TotalMailAccess = count(),\n DistinctMailboxes = dcount(AccessedMailbox),\n MailboxList = make_set(AccessedMailbox, 20),\n UserAgents = make_set(UserAgent, 5)\n by ClientIP, bin(TimeGenerated, 1d)\n| where DistinctMailboxes >= distinctMailboxThreshold\n and TotalMailAccess >= minMailAccessCount\n| extend AccessesPerMailbox = round(toreal(TotalMailAccess) / DistinctMailboxes, 1)\n| extend IsApiAccess = array_length(UserAgents) == 0\n or (array_length(UserAgents) == 1 and UserAgents[0] == \"\")\n| join kind=leftouter (\n ThreatIntelIndicators\n | where IsActive == true and IsDeleted == false\n | where ObservableKey == \"ipv4-addr:value\"\n | where isnotempty(ObservableValue)\n | summarize\n ThreatTags=make_set(Tags),\n TIConfidence=max(Confidence)\n by ObservableValue\n) on $left.ClientIP == $right.ObservableValue\n| extend IsThreatIP = isnotnull(TIConfidence)\n| extend ThreatTags = iff(IsThreatIP, ThreatTags, dynamic([]))\n| extend TIConfidence = iff(IsThreatIP, TIConfidence, 0)\n| project FirstAccess, LastAccess, ClientIP,\n DistinctMailboxes, TotalMailAccess, AccessesPerMailbox,\n IsApiAccess, IsThreatIP, ThreatTags, TIConfidence,\n MailboxList, UserAgents\n | where isempty('{IPFilter}') or ClientIP contains '{IPFilter}'\n| order by IsThreatIP desc, IsApiAccess desc, DistinctMailboxes desc\n| summarize Count=count() by ClientIP\n| top 10 by Count\n| render barchart", "size": 0, "title": "Multi-Mailbox Access by Single IP via Cloud App Permissions (by ClientIP)", "noDataMessage": "βœ… No single-IP multi-mailbox access in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "chartSettings": { "xAxis": "ClientIP", "yAxis": [ "Count" ], "showDataLabels": true, "createOtherGroup": null } }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ex-e3-multi-mailbox-ip", "id": "c399878d-4751-4987-8f9b-35882625c12f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\nlet distinctMailboxThreshold = 10;\nlet minMailAccessCount = 100;\nCloudAppEvents\n| where TimeGenerated between (StartTime .. EndTime)\n| where ActionType == \"MailItemsAccessed\"\n| extend AccessedMailbox = tostring(RawEventData.UserId)\n| extend ClientIP = tostring(RawEventData.ClientIP)\n| extend UserAgent = tostring(RawEventData.UserAgent)\n| where isnotempty(AccessedMailbox) and isnotempty(ClientIP)\n| summarize\n FirstAccess = min(TimeGenerated),\n LastAccess = max(TimeGenerated),\n TotalMailAccess = count(),\n DistinctMailboxes = dcount(AccessedMailbox),\n MailboxList = make_set(AccessedMailbox, 20),\n UserAgents = make_set(UserAgent, 5)\n by ClientIP, bin(TimeGenerated, 1d)\n| where DistinctMailboxes >= distinctMailboxThreshold\n and TotalMailAccess >= minMailAccessCount\n| extend AccessesPerMailbox = round(toreal(TotalMailAccess) / DistinctMailboxes, 1)\n| extend IsApiAccess = array_length(UserAgents) == 0\n or (array_length(UserAgents) == 1 and UserAgents[0] == \"\")\n| join kind=leftouter (\n ThreatIntelIndicators\n | where IsActive == true and IsDeleted == false\n | where ObservableKey == \"ipv4-addr:value\"\n | where isnotempty(ObservableValue)\n | summarize\n ThreatTags=make_set(Tags),\n TIConfidence=max(Confidence)\n by ObservableValue\n) on $left.ClientIP == $right.ObservableValue\n| extend IsThreatIP = isnotnull(TIConfidence)\n| extend ThreatTags = iff(IsThreatIP, ThreatTags, dynamic([]))\n| extend TIConfidence = iff(IsThreatIP, TIConfidence, 0)\n| project FirstAccess, LastAccess, ClientIP,\n DistinctMailboxes, TotalMailAccess, AccessesPerMailbox,\n IsApiAccess, IsThreatIP, ThreatTags, TIConfidence,\n MailboxList, UserAgents\n | where isempty('{IPFilter}') or ClientIP contains '{IPFilter}'\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", ClientIP, \"/overview\")\n| order by IsThreatIP desc, IsApiAccess desc, DistinctMailboxes desc\n| limit 25", "size": 0, "title": "Multi-Mailbox Access by Single IP via Cloud App Permissions - Detailed", "noDataMessage": "βœ… No single-IP multi-mailbox access in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "IsThreatIP", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "redBright", "text": "🚨 Known Threat IP" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "βœ“ No TI match" } ] } }, { "columnMatch": "DistinctMailboxes", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "50", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "20", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "TotalMailAccess", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "1000", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "500", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "IsApiAccess", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "orange", "text": "⚠️ API / no UA" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "Browser UA" } ] } }, { "columnMatch": "TIConfidence", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "75", "representation": "redBright", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "50", "representation": "orange", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "FirstAccess", "formatter": 6 }, { "columnMatch": "LastAccess", "formatter": 6 } ], "labelSettings": [ { "columnId": "ClientIP", "label": "Source IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "DistinctMailboxes", "label": "Distinct Mailboxes" }, { "columnId": "TotalMailAccess", "label": "Mail Accesses" }, { "columnId": "AccessesPerMailbox", "label": "Accesses / Mailbox" }, { "columnId": "IsApiAccess", "label": "Access Type" }, { "columnId": "IsThreatIP", "label": "Threat Intel" }, { "columnId": "ThreatTags", "label": "TI Tags" }, { "columnId": "TIConfidence", "label": "TI Confidence" }, { "columnId": "MailboxList", "label": "Mailboxes (sample)" }, { "columnId": "UserAgents", "label": "User Agents" }, { "columnId": "FirstAccess", "label": "First Access" }, { "columnId": "LastAccess", "label": "Last Access" } ] } }, "conditionalVisibilities": [ { "parameterName": "UserFilter", "comparison": "isEqualTo", "value": "" }, { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "50", "name": "ex-e3-multi-mailbox-ip-detail", "id": "b4ae259a-b11e-45f5-bbba-432fcdcc07eb" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " let StartTime = {TimeRange:start};\n let EndTime = {TimeRange:end};\nlet orgDomains = dynamic([\"contoso.com\", \"contoso.onmicrosoft.com\"]);\nCloudAppEvents\n| where TimeGenerated between (StartTime .. EndTime)\n| where ActionType in (\"New-InboxRule\", \"Set-InboxRule\", \"Set-Mailbox\")\n| extend UserUPN = tostring(RawEventData.UserId)\n| extend ClientIP = tostring(RawEventData.ClientIP)\n| mv-expand Param = RawEventData.Parameters\n| extend ParamName = tostring(Param.Name)\n| extend ParamValue = tostring(Param.Value)\n| where ParamName in (\n \"ForwardTo\", \"ForwardAsAttachmentTo\",\n \"RedirectTo\", \"ForwardingSmtpAddress\",\n \"ForwardingAddress\", \"DeliverToMailboxAndForward\")\n| where isnotempty(ParamValue) and ParamValue !~ \"False\"\n| summarize\n FirstSeen=min(TimeGenerated),\n LastSeen=max(TimeGenerated),\n ActionTypes=make_set(ActionType),\n ClientIPs=make_set(ClientIP)\n by UserUPN, ParamName, ForwardingAddress=ParamValue\n| extend ForwardingDomain = tostring(split(ForwardingAddress, \"@\")[1])\n| extend IsExternalForward = isnotempty(ForwardingDomain)\n and not(orgDomains has tolower(ForwardingDomain))\n and ForwardingAddress !~ \"False\"\n| where IsExternalForward == true\n| project FirstSeen, LastSeen, UserUPN, ForwardingAddress,\n ForwardingDomain, ParamName, ActionTypes, ClientIPs\n | where isempty('{UserFilter}') or UserUPN contains '{UserFilter}'\n| where isempty('{IPFilter}') or tostring(ClientIPs) contains '{IPFilter}'\n| order by FirstSeen desc\n| limit 25", "size": 0, "title": "Email Forwarding Rule Created to External Address", "noDataMessage": "βœ… No external email-forwarding rules created in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "ParamName", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "ForwardingSmtpAddress", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "ForwardingAddress", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "RedirectTo", "representation": "redBright", "text": "🚨 {0}" }, { "operator": "==", "thresholdValue": "ForwardTo", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "==", "thresholdValue": "ForwardAsAttachmentTo", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "==", "thresholdValue": "DeliverToMailboxAndForward", "representation": "orange", "text": "⚠️ {0}" }, { "operator": "Default", "thresholdValue": null, "representation": "blue", "text": "{0}" } ] } }, { "columnMatch": "FirstSeen", "formatter": 6 }, { "columnMatch": "LastSeen", "formatter": 6 } ], "labelSettings": [ { "columnId": "FirstSeen", "label": "First Seen" }, { "columnId": "LastSeen", "label": "Last Seen" }, { "columnId": "UserUPN", "label": "User (UPN)" }, { "columnId": "ForwardingAddress", "label": "Forwarding Address" }, { "columnId": "ForwardingDomain", "label": "External Domain" }, { "columnId": "ParamName", "label": "Forwarding Method" }, { "columnId": "ActionTypes", "label": "Action Types" }, { "columnId": "ClientIPs", "label": "Client IPs" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "ex-e4-email-forwarding", "id": "fd7688b4-5b68-457b-a1b9-48f03d08d12f" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let StartTime = {TimeRange:start};\nlet EndTime = {TimeRange:end};\nlet sensitivePermissions = dynamic([\n \"Mail.Read\", \"Mail.ReadWrite\", \"Mail.Read.All\", \"Mail.ReadWrite.All\",\n \"Mail.Send\", \"Mail.Send.Shared\",\n \"Files.Read.All\", \"Files.ReadWrite.All\",\n \"Sites.Read.All\", \"Sites.ReadWrite.All\",\n \"MailboxSettings.Read\", \"Contacts.Read\",\n \"User.Read.All\", \"Directory.Read.All\"]);\nlet knownLegitApps = dynamic([\n \"Microsoft Graph Command Line Tools\",\n \"Microsoft Graph PowerShell\",\n \"Microsoft Graph PowerShell (Preview)\",\n \"Graph Explorer\",\n \"Graph explorer (official site)\",\n \"Microsoft Services Backup\",\n \"Microsoft 365\",\n \"Phish Alert Button (US)\",\n \"Phish Alert Button (US) (N)\",\n \"PhishAlarm for Exchange (AP)\",\n \"Composio - Outlook\",\n \"Zapier Outlook\",\n \"ClickUp (Email Integration)\",\n \"monday.com\",\n \"Salesforce Inbox\",\n \"PnP PowerShell\",\n \"PnP Powershell\"]);\nAuditLogs\n| where TimeGenerated between (StartTime .. EndTime)\n| where OperationName in (\n \"Consent to application\",\n \"Add delegated permission grant\",\n \"Add app role assignment to service principal\")\n| where Result =~ \"success\"\n| extend ActorUPN = tostring(InitiatedBy.user.userPrincipalName)\n| extend ActorIPAddress = tostring(InitiatedBy.user.ipAddress)\n| mv-expand ModifiedProp = TargetResources[0].modifiedProperties\n| extend PropName = tostring(ModifiedProp.displayName)\n| extend PropNewValue = trim('\"', tostring(ModifiedProp.newValue))\n| summarize\n ConsentTime=min(TimeGenerated),\n ActorUPN=any(ActorUPN),\n ActorIPAddress=any(ActorIPAddress),\n AppName=anyif(tostring(TargetResources[0].displayName), OperationName == \"Consent to application\"),\n SPNameFromProp=anyif(PropNewValue, PropName == \"ServicePrincipal.DisplayName\" and isnotempty(PropNewValue)),\n SPObjectId=anyif(PropNewValue, PropName == \"ServicePrincipal.ObjectID\"),\n SPAppId=anyif(PropNewValue, PropName == \"ServicePrincipal.AppId\"),\n GrantedScopes=anyif(PropNewValue, PropName == \"DelegatedPermissionGrant.Scope\"),\n GrantedAppRole=anyif(PropNewValue, PropName == \"AppRole.Value\"),\n ConsentOnBehalfOfAll=anyif(PropNewValue, PropName == \"ConsentContext.OnBehalfOfAll\"),\n OperationNames=make_set(OperationName)\n by CorrelationId\n| extend AppName = coalesce(AppName, SPNameFromProp, SPObjectId)\n| where AppName !in~ (knownLegitApps)\n| extend AllPermissions = split(trim(\" \", strcat(GrantedScopes, \" \", GrantedAppRole)), \" \")\n| extend GrantedSensitivePerms = set_intersect(AllPermissions, sensitivePermissions)\n| where array_length(GrantedSensitivePerms) > 0\n| extend IsAdminConsent = OperationNames has \"Add app role assignment to service principal\" or ConsentOnBehalfOfAll == \"True\"\n| extend SensitivePermCount = array_length(GrantedSensitivePerms)\n| summarize\n FirstConsentTime=min(ConsentTime),\n LastConsentTime=max(ConsentTime),\n ActorUPN=any(ActorUPN),\n ActorIPAddress=any(ActorIPAddress),\n AppName=any(AppName),\n SPAppId=any(SPAppId),\n GrantedScopes=any(GrantedScopes),\n GrantedSensitivePerms=any(GrantedSensitivePerms),\n SensitivePermCount=max(SensitivePermCount),\n IsAdminConsent=max(toint(IsAdminConsent)),\n ConsentCount=count()\n by SPObjectId\n| extend IsAdminConsent = tobool(IsAdminConsent)\n| extend IsAppNameGuid = AppName matches regex @\"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\"\n| extend HasFullControl = GrantedScopes has \"FullControl\"\n| extend NoActorUPN = isempty(ActorUPN)\n| extend RiskScore = toint(IsAppNameGuid) + toint(HasFullControl) + toint(NoActorUPN) + toint(SensitivePermCount > 5)\n| where SensitivePermCount >= 3 or RiskScore > 0\n| project FirstConsentTime, LastConsentTime, AppName, SPAppId, SPObjectId, ActorUPN, ActorIPAddress,\n GrantedSensitivePerms, SensitivePermCount, IsAdminConsent, HasFullControl,\n IsAppNameGuid, NoActorUPN, ConsentCount, RiskScore\n| extend XDRIPUrl = strcat(\"https://security.microsoft.com/ip/\", ActorIPAddress, \"/overview\"), EntraAppUrl = strcat(\"https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/\", SPObjectId, \"/appId/\", SPAppId)\n| where isempty('{UserFilter}') or ActorUPN contains '{UserFilter}'\n| where isempty('{IPFilter}') or ActorIPAddress contains '{IPFilter}'\n| order by RiskScore desc, SensitivePermCount desc\n| limit 25", "size": 0, "title": "Suspicious OAuth App Consent Granting Sensitive Permissions", "noDataMessage": "βœ… No suspicious sensitive-permission consents in this window.", "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "RiskScore", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "4", "representation": "redBright", "text": "🚨 {0} - Critical" }, { "operator": "==", "thresholdValue": "3", "representation": "redBright", "text": "πŸ”΄ {0} - High" }, { "operator": "==", "thresholdValue": "2", "representation": "orange", "text": "⚠️ {0} - Medium" }, { "operator": "==", "thresholdValue": "1", "representation": "yellow", "text": "🟑 {0} - Low" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "🟒 {0} - Informational" } ] } }, { "columnMatch": "SensitivePermCount", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "5", "representation": "redBright", "text": "🚨 {0}{1}" }, { "operator": ">=", "thresholdValue": "3", "representation": "orange", "text": "⚠️ {0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "{0}{1}" } ] } }, { "columnMatch": "IsAdminConsent", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "redBright", "text": "🚨 Admin (tenant-wide)" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "User consent" } ] } }, { "columnMatch": "HasFullControl", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "redBright", "text": "🚨 FullControl" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "β€”" } ] } }, { "columnMatch": "IsAppNameGuid", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "orange", "text": "⚠️ Unnamed (GUID)" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "Named" } ] } }, { "columnMatch": "NoActorUPN", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "true", "representation": "orange", "text": "⚠️ Anonymous" }, { "operator": "Default", "thresholdValue": null, "representation": "green", "text": "Known" } ] } }, { "columnMatch": "XDRIPUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ” Investigate IP" } }, { "columnMatch": "EntraAppUrl", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "πŸ”— View App" } }, { "columnMatch": "FirstConsentTime", "formatter": 6 }, { "columnMatch": "LastConsentTime", "formatter": 6 } ], "labelSettings": [ { "columnId": "FirstConsentTime", "label": "First Consent" }, { "columnId": "LastConsentTime", "label": "Last Consent" }, { "columnId": "AppName", "label": "App Name" }, { "columnId": "SPAppId", "label": "App ID" }, { "columnId": "SPObjectId", "label": "SP Object ID" }, { "columnId": "ActorUPN", "label": "Actor (UPN)" }, { "columnId": "ActorIPAddress", "label": "Actor IP" }, { "columnId": "XDRIPUrl", "label": "XDR" }, { "columnId": "EntraAppUrl", "label": "Entra" }, { "columnId": "GrantedSensitivePerms", "label": "Sensitive Permissions" }, { "columnId": "SensitivePermCount", "label": "Sensitive Perm Count" }, { "columnId": "IsAdminConsent", "label": "Consent Type" }, { "columnId": "HasFullControl", "label": "Full Control" }, { "columnId": "IsAppNameGuid", "label": "App Identity" }, { "columnId": "NoActorUPN", "label": "Actor Identity" }, { "columnId": "ConsentCount", "label": "Consents" }, { "columnId": "RiskScore", "label": "Risk (0-4)" } ] } }, "conditionalVisibilities": [ { "parameterName": "DeviceFilter", "comparison": "isEqualTo", "value": "" } ], "customWidth": "100", "name": "ex-e5-oauth-consent-sensitive", "id": "09b43a2c-7848-44d9-af4f-3b98e392dedf" } ] }, "conditionalVisibility": { "parameterName": "isExfiltrationVisible", "comparison": "isEqualTo", "value": "true" }, "name": "section-8-Exfiltration", "id": "8eb1baa2-6e92-4cd7-8a0b-2e307816586b" } ], "fallbackResourceIds": [], "fromTemplateId": "sentinel-HybridAttackWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }