Auditlogs Unexpected Device Os Type Modification

KQL detection rule by ep3p · MIT

No description provided

AuditLogs
| where OperationName == "Update device" and Result == "success"
| mv-apply modifiedProperty = TargetResources[0]["modifiedProperties"] on (
    summarize modifiedProperties = make_bag(bag_pack(tostring(modifiedProperty["displayName"]), bag_pack("oldValue", translate(@'["\]', "", tostring(modifiedProperty["oldValue"])), "newValue", translate(@'["\]', "", tostring(modifiedProperty["newValue"])))))
    )
| where isnotempty(tostring(modifiedProperties["CloudDeviceOSType"]["oldValue"])) or isnotempty(tostring(modifiedProperties["DeviceOSType"]["oldValue"]))
| extend
    CloudDeviceOSTypeOldValue = tolower(tostring(modifiedProperties["CloudDeviceOSType"]["oldValue"])),
    CloudDeviceOSTypeNewValue = tolower(tostring(modifiedProperties["CloudDeviceOSType"]["newValue"])),
    DeviceOSTypeOldValue = tolower(tostring(modifiedProperties["DeviceOSType"]["oldValue"])),
    DeviceOSTypeNewValue = tolower(tostring(modifiedProperties["DeviceOSType"]["newValue"])),
    DeviceObjectId = tostring(TargetResources[0]["id"]),
    DeviceId = tostring(modifiedProperties["TargetId.DeviceId"]["newValue"]),
    AuxiliarDeviceDisplayName = tostring(TargetResources[0]["displayName"])
| summarize
    StartTime = arg_min(TimeGenerated, *),
    (EndTime, DeviceDisplayName) = arg_max(TimeGenerated, AuxiliarDeviceDisplayName),
    OSTypeOldValues = array_sort_asc(make_set(pack_array(CloudDeviceOSTypeOldValue, DeviceOSTypeOldValue))),
    OSTypeNewValues = array_sort_asc(make_set(pack_array(CloudDeviceOSTypeNewValue, DeviceOSTypeNewValue))),
    CorrelationIds = make_set(CorrelationId)
    by DeviceObjectId, DeviceId
| where not(array_length(OSTypeOldValues) == 1 and OSTypeOldValues[0] == "unknown")
| extend
    OSTypeOldValuesReplaced = tostring(set_union(todynamic(replace_strings(tostring(OSTypeOldValues),
        dynamic(["macmdm",  "iphone",   "ipad", "androidaosp",  "androidenterprise",    "androidforwork"]),
        dynamic(["macos",   "ios",      "ios",  "android",      "android",              "android"])
    )), dynamic([]))),
    OSTypeNewValuesReplaced = tostring(set_union(todynamic(replace_strings(tostring(OSTypeNewValues),
        dynamic(["macmdm",  "iphone",   "ipad", "androidaosp",  "androidenterprise",    "androidforwork"]),
        dynamic(["macos",   "ios",      "ios",  "android",      "android",              "android"])
    )), dynamic([])))
| where not(OSTypeOldValuesReplaced == OSTypeNewValuesReplaced)
| extend
    Initiator = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["displayName"]), tostring(InitiatedBy["user"]["userPrincipalName"])),
    InitiatorId = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["servicePrincipalId"]), tostring(InitiatedBy["user"]["id"])),
    IPAddress = tostring(InitiatedBy[tostring(bag_keys(InitiatedBy)[0])]["ipAddress"])
| project
    StartTime,
    EndTime,
    LoggedByService,
    Category,
    AADOperationType,
    Initiator,
    IPAddress,
    OperationName,
    Result,
    DeviceDisplayName,
    DeviceId,
    DeviceObjectId,
    OSTypeOldValues,
    OSTypeNewValues,
    AdditionalDetails,
    Identity,
    InitiatorId,
    InitiatedBy,
    TargetResources,
    CorrelationIds

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2d1b35b6-6940-4843-a2bd-58ea2fd097f4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion