Multiple Activity With Entra Id Break Glass Account
KQL detection rule by ep3p · MIT
No description provided
let _BreakGlassUserId = toscalar(
_GetWatchlist("Activity-ExpectedSignificantActivity")
| where Activity == "EntraIDBreakGlass"
| summarize make_list(ActorId)
);
union
(
union SigninLogs, AADNonInteractiveUserSignInLogs
| where UserId in (_BreakGlassUserId)
| summarize
StartTime = min(TimeGenerated),
EndTime = max(TimeGenerated),
ResultTypes = array_sort_asc(make_set(ResultType, 50)),
AppDisplayNames = array_sort_asc(make_set(AppDisplayName, 50)),
ResourcesDisplayNames = array_sort_asc(make_set(ResourceDisplayName, 50)),
UserAgents = make_set(UserAgent, 50),
take_any(UserPrincipalName, UserDisplayName, AlternateSignInName, Location)
by IPAddress, UserId
| project
StartTime,
EndTime,
UserPrincipalName,
UserDisplayName,
AlternateSignInName,
IPAddress,
Location,
ResultTypes,
AppDisplayNames,
ResourcesDisplayNames,
UserAgents,
UserId
),
(
AuditLogs
| mv-expand TargetResource = TargetResources
| where TargetResource["type"] == "User"
| extend TargetId = tostring(TargetResource["id"])
| where TargetId in (_BreakGlassUserId)
| extend
Initiator = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["displayName"]), tostring(InitiatedBy["user"]["userPrincipalName"])),
InitiatorId = iif(isnotempty(InitiatedBy["app"]), tostring(InitiatedBy["app"]["servicePrincipalId"]), tostring(InitiatedBy["user"]["id"])),
IPAddress = tostring(InitiatedBy[tostring(bag_keys(InitiatedBy)[0])]["ipAddress"]),
TargetUserPrincipalName = tostring(TargetResource["userPrincipalName"])
| project
TimeGenerated,
LoggedByService,
Category,
AADOperationType,
Initiator,
IPAddress,
OperationName,
Result,
ResultDescription,
TargetUserPrincipalName,
TargetId,
AdditionalDetails,
InitiatorId,
InitiatedBy,
TargetResources,
CorrelationId
)