EXPLORE DETECTIONS
MicrosoftGraphActivityLogs App Enrichment ExternalData Based
This query enriches the *MicrosoftGraphActivityLogs* with Application information Using the Azure_Application_ID list developed by [@Beercow](https://github.com/Beercow) 1000+ AppIds can be enriched with the [externaldata operator](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/externaldata-operator?pivots=azuredataexplorer) resulting in the query below.
MicrosoftGraphActivityLogs IP Enrichment
The IP information can be enriched using the [geo_info_from_ip_address()](https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/geo-info-from-ip-address-function) function, which returns the country, state, city, latitude and longitude of each IPv4 and IPv6 address.
MicrosoftGraphActivityLogs User Enrichment
This query enriches the *MicrosoftGraphActivityLogs* with userinformation from the *IdentityInfo* table to get more context in the results.
Modifications To ApplicationManagementPolicy for Entra App Registrations
This query looks for modifications to ApplicationManagementPolicy which could be someone attempting to bypass an app management policy that blocks client secrets being used for an app registration
Modifications to Azure DNS Zones
Ensure you have read-only Resource Locks for critical DNS Zones and Azure Policy deny delete actions on all critical zones
Modifications to SafeLinks AllowClickThrough Policy
Monitor DLLs by Signer
change to 30d if using advanced hunting with no sentinel
Monitor ransomwarelive for companies of interest on ransowmare data leak sites (DLS)
This allows you to monitor the ransomware.live dataset for possible companies of interest being breached and posted by ransomware groups on data leak sites (DLS).
Most Permissive Entities
This query lists the top 100 entities that have the most permissions to perform a certain action on a resource. The query extracts the type of permissions, such as reader, contributor, owner and other (custom) roles. It is good practice to review the users with the most permissions, or put additional monitoring on their accounts. Because they are highly priviliged threat actors can perform a lot of actions once the account has been taken over.
Most Recent Sign-in time for users in the last 30 days
Note this will not work if the user has no sign-in at ALL in the last 30 days. For reporting on last sign-ins for all users regardless of timewindow I would check out https://o365reports.com/2023/06/21/microsoft-365-inactive-user-report-ms-graph-powershell/
Most Triggered Incidents
The results of this query provide insight in the top 10 incidents that have triggered in your selected *timeframe*, this can give indications on which incidents should be addressed to limit potential false positives.
Most Triggered Mitre Techniques
The results of this query provide insight in the top 10 MITRE ATT&CK Techniques that have been triggered in the past 10 days. This can indicate that adversaries use specific techniques to gain access to your environment. On the otherhand if this information is combined with FP/BP statistics it can give insight into the detections that need to be improved.
MS Exchange Zero Day (Sept 2022)
MS Exchange Zero Day (Sept 2022)
MSHTA Executions
This query lists all mshta executions, or if mshta is used legitimately can be used to filter on suspicious mshta child processes.
Multiple Accounts Locked
Detect when multiple accounts are locked in your Azure tenant in a short timeframe, this can indicate brute force or password spray attacks. This detection is based on error code 50053 wich results from two different reasons:
Multiple Sensitive Group Additions From Commandline
This query detects when multiple sentitive group additions have been initiated from the commandline within a certain timeframe. This timeframe can be configured using the *BinTimeFrame* variable. The *AlertThreshold* can be used to tweak the detection to met a certain threshold that you want to aim for, if set to one every commandline addition will be alerted.
Net(1).exe Query Statistics
This query can be used to list the statistics of the entities that have been queried in the last x days. The x is determined by the *StartTime* parameter. Only the (local)group and user query types are included in this query. This query can be used to list the user/groups that are often queried or to list rare discovery activities.
Netskope Malicious CloudWorker Detection
This query checks DeviceNetworkEvents against known malicious Cloudflare workers from Netskope
New access credential added to application or service principal
This query will find when a new credential is added to an application or service principal.
New Active CISA Know Exploited Vulnerability Detected
CISA provides a comprehensive list of known exploited vulnerabilities with CVE numbers, vendor names, product names, vulnerability names, dates, short descriptions, action due dates, and notes. This dynamic list is ingested into a KQL query to detect newly added known exploited vulnerabilities that are active in your environment.
New Authentication App Detected
Detect a new app that is used to send authentication request to your tenant. The authentication requests do not have to be successful. The app can eighter be an internal app, then the AppID is filled, if that is not the case then it is an external app. A false positive is a new app that is used within your organization.
New LOLBIN with external connection
This query searches for new lolbins that have executed external connections. This is done by first listing all lolbins that are known to execute external connections, for example msedge.exe will (of course) trigger external connections. With this query you can list rare lolbins which are uncommon to trigger external connections. The list of LOLBINS is based on the lolbas project.
New TABL Entry using OfficeActivity
let SI = union SigninLogs, AADNonInteractiveUserSignInLogs
New TenantAllowBlockList (TABL) entry
| project-reorder Notes, Url, Expiration