Analytics Authenticationmethodchangesold
KQL detection rule by ep3p · MIT
This query can help you to check accounts that changed their MFA or Authentication Methods in Azure AD Click "Save as function", in Parameters write in the fields: "timespan" "query_period" "1d" "dynamic" "query_userids" "dynamic([])" "bool" "check_signinlogs" "false" If you name the function "AuthenticationMethodChanges", you can check the function with queries like the following: AuthenticationMethodChanges() AuthenticationMethodChanges(2d, dynamic(["00000000-0000-0000-0000-000000000000","00000000-0000-0000-0000-000000000001"])) let Function = (query_period:timespan = 1d, query_userids:dynamic = dynamic([]), check_signinlogs:bool = true){ CoreDirectory Resources
// This query can help you to check accounts that changed their MFA or Authentication Methods in Azure AD
//
// Click "Save as function", in Parameters write in the fields:
// "timespan" "query_period" "1d"
// "dynamic" "query_userids" "dynamic([])"
// "bool" "check_signinlogs" "false"
//
// If you name the function "AuthenticationMethodChanges", you can check the function with queries like the following:
//
// AuthenticationMethodChanges()
//
// AuthenticationMethodChanges(2d, dynamic(["00000000-0000-0000-0000-000000000000","00000000-0000-0000-0000-000000000001"]))
//
//let Function = (query_period:timespan = 1d, query_userids:dynamic = dynamic([]), check_signinlogs:bool = true){
// CoreDirectory Resources
let MicrosoftGraph_id = "00000003-0000-0000-c000-000000000000"; // Microsoft Graph
let WindowsAzureActiveDirectory_id = "00000002-0000-0000-c000-000000000000"; // Windows Azure Active Directory
let MicrosoftAppAccessPanel_id = "0000000c-0000-0000-c000-000000000000"; // Microsoft App Access Panel
let MicrosoftApprovalManagement_id = "65d91a3d-ab74-42e6-8a2f-0add61688c74"; // Microsoft Approval Management
let Microsofpasswordresetservice_id = "93625bc8-bfe2-437a-97e0-3d0060024faa"; // Microsoft password reset service
// Azure MFA Resources
let AzureMultiFactorAuthConnector_id = "1f5530b3-261a-47a9-b357-ded261e17918"; // Azure Multi-Factor Auth Connector
// let _HomeTenantIds = toscalar(
// _GetWatchlist('UUID-AADTenantIds')
// | where Notes has "[HomeTenant]"
// | summarize make_list(TenantId)
// );
// "Security Info" authentication method changes (LoggedByService: "Azure MFA", "Authentication Methods", etc)
let _SecurityInfoChanges =
AuditLogs
| where TimeGenerated > ago(query_period)
| where (OperationName has "security info"
and OperationName has_any ("User", "Admin")
and OperationName has_any ("started", "changed", "registered", "updated", "reviewed", "deleted"))
or OperationName has_any ("Disable Strong Authentication", "platform credential", "passwordless phone sign-in credential", "Windows Hello for Business credential", "FIDO2 security key", "Add Passkey") // "Delete Passkey"?
//and Result == "success"
| extend UserId = tolower(TargetResources[0].id)
| where array_length(query_userids) == 0 or UserId in (query_userids)
// The below code will implicitly remove failure events
// "Security Info" changes have associated a "Update user" event
| join kind=leftouter (
AuditLogs
| where TimeGenerated > ago(query_period)
| where OperationName == "Update user"
// Remove synchronization update user events
| where not(TargetResources has "LastDirSyncTime")
| extend UserId = tolower(TargetResources[0].id)
| project
UpdateUser_TimeGenerated = TimeGenerated,
UpdateUser_TargetResources = TargetResources,
UpdateUser_CorrelationId = CorrelationId,
UserId
) on UserId
| project-away UserId1
| where not(isnotempty(UpdateUser_TimeGenerated) and UpdateUser_TimeGenerated > TimeGenerated)
| mv-apply ModifiedProperty = UpdateUser_TargetResources[0].modifiedProperties on (
summarize BagToUnpack = make_bag(pack(tostring(ModifiedProperty.displayName), translate(@'["\]', "", tostring(ModifiedProperty.newValue))))
)
| evaluate bag_unpack(BagToUnpack, columnsConflict = 'keep_source')
// Remove empty updates
| where not(column_ifexists("Included Updated Properties", "") == "")
// Take the most recent update user event
| summarize arg_max(UpdateUser_TimeGenerated, *) by CorrelationId
;
// "Azure MFA" authentication method change attempts may leave a trace at AADNonInteractiveUserSignInLogs
let _AzureMFA_AuthMethodSignInLogs =
AADNonInteractiveUserSignInLogs
| where check_signinlogs and TimeGenerated > ago(query_period)
| where ResultType == 0
//and HomeTenantId in (_HomeTenantIds)
and UserId in (toscalar(_SecurityInfoChanges | summarize make_set(UserId)))
and ResourceIdentity in (AzureMultiFactorAuthConnector_id)
| lookup kind=inner (
_SecurityInfoChanges
| project
SecurityInfo_TimeGenerated = TimeGenerated,
SecurityInfo_CorrelationId = CorrelationId,
UserId
) on UserId
| where TimeGenerated < SecurityInfo_TimeGenerated
| summarize arg_max(TimeGenerated, *) by SecurityInfo_CorrelationId
| summarize arg_max(TimeGenerated, *) by CorrelationId
| project TimeGenerated, UserPrincipalName, UserDisplayName, IPAddress, Location, ResultType, ResultDescription, ClientAppUsed, AppDisplayName, ResourceDisplayName, DeviceDetail, UserAgent, AuthenticationDetails, RiskState, RiskEventTypes, RiskLevelDuringSignIn, RiskLevelAggregated, UserId, OriginalRequestId, CorrelationId
| project-rename
SignInLogs_TimeGenerated = TimeGenerated,
SignInLogs_IPAddress = IPAddress,
SignInLogs_ResultDescription = ResultDescription,
SignInLogs_CorrelationId = CorrelationId
;
let _SecurityInfoChanges_CorrelationIds = toscalar(
_SecurityInfoChanges
| summarize make_list(UpdateUser_CorrelationId)
);
// Some authentication method changes do not trigger a "security info" event (LoggedByService: CoreDirectory)
let _StrongAuthenticationMethodUpdates =
AuditLogs
| where TimeGenerated > ago(query_period)
| where OperationName == "Update user" //and Result == "success"
| where not(CorrelationId in (_SecurityInfoChanges_CorrelationIds))
| mv-expand modifiedProperty = TargetResources[0].modifiedProperties
| where modifiedProperty.displayName startswith "StrongAuthentication"
| where not(modifiedProperty.displayName == "StrongAuthenticationPhoneAppDetail"
and tostring(array_sort_asc(extract_all(@'\"Id\"\:\"([^\"]+)\"', tostring(modifiedProperty.newValue)))) == tostring(array_sort_asc(extract_all(@'\"Id\"\:\"([^\"]+)\"', tostring(modifiedProperty.oldValue)))))
| project-away modifiedProperty
| extend
UserId = tolower(TargetResources[0].id),
UpdateUser_CorrelationId = CorrelationId
| where array_length(query_userids) == 0 or UserId in (query_userids)
| project-rename UpdateUser_TargetResources = TargetResources
;
// CoreDirectory authentication method change attempts may leave a trace at AADNonInteractiveUserSignInLogs
let _CoreDirectory_AuthMethodSignInLogs =
AADNonInteractiveUserSignInLogs
| where check_signinlogs and TimeGenerated > ago(query_period)
| where ResultType == 0
//and HomeTenantId in (_HomeTenantIds)
and UserId in (toscalar(_StrongAuthenticationMethodUpdates | summarize make_set(UserId)))
and ResourceIdentity in (
//MicrosoftGraph_id,
WindowsAzureActiveDirectory_id,
MicrosoftAppAccessPanel_id,
//MicrosoftApprovalManagement_id,
Microsofpasswordresetservice_id
)
| summarize hint.strategy = shuffle
arg_min(TimeGenerated, *),
//MicrosoftGraph_TimeGenerated = take_anyif(TimeGenerated, ResourceIdentity == MicrosoftGraph_id),
WindowsAzureActiveDirectory_TimeGenerated = take_anyif(TimeGenerated, ResourceIdentity == WindowsAzureActiveDirectory_id),
MicrosoftAppAccessPanel_TimeGenerated = take_anyif(TimeGenerated, ResourceIdentity == MicrosoftAppAccessPanel_id),
//MicrosoftApprovalManagement_TimeGenerated = take_anyif(TimeGenerated, ResourceIdentity == MicrosoftApprovalManagement_id),
Microsofpasswordresetservice_TimeGenerated = take_anyif(TimeGenerated, ResourceIdentity == Microsofpasswordresetservice_id)
by CorrelationId
| where isnotempty(WindowsAzureActiveDirectory_TimeGenerated)
and isnotempty(MicrosoftAppAccessPanel_TimeGenerated)
//and isnotempty(MicrosoftApprovalManagement_TimeGenerated)
and isnotempty(Microsofpasswordresetservice_TimeGenerated)
//and isnotempty(MicrosoftGraph_TimeGenerated)
| lookup kind=inner (
_StrongAuthenticationMethodUpdates
| project
UpdateUser_TimeGenerated = TimeGenerated,
UpdateUser_CorrelationId = CorrelationId,
UserId
) on UserId
| where TimeGenerated < UpdateUser_TimeGenerated
| summarize arg_max(TimeGenerated, *) by UpdateUser_CorrelationId
| summarize arg_max(TimeGenerated, *) by CorrelationId
| project TimeGenerated, UserPrincipalName, UserDisplayName, IPAddress, Location, ResultType, ResultDescription, ClientAppUsed, AppDisplayName, ResourceDisplayName, DeviceDetail, UserAgent, AuthenticationDetails, RiskState, RiskEventTypes, RiskLevelDuringSignIn, RiskLevelAggregated, UserId, OriginalRequestId, CorrelationId
| project-rename
SignInLogs_TimeGenerated = TimeGenerated,
SignInLogs_IPAddress = IPAddress,
SignInLogs_ResultDescription = ResultDescription,
SignInLogs_CorrelationId = CorrelationId
;
union
(_SecurityInfoChanges
| project TimeGenerated, OperationName, Result, ResultDescription, LoggedByService, InitiatedBy, UpdateUser_TargetResources, UserId, CorrelationId, SecurityInfo_TargetResources = TargetResources
| join kind=leftouter _AzureMFA_AuthMethodSignInLogs on UserId
),
(_StrongAuthenticationMethodUpdates
| project TimeGenerated, OperationName, Result, ResultDescription, LoggedByService, InitiatedBy, UpdateUser_TargetResources, UserId, CorrelationId
| join kind=leftouter _CoreDirectory_AuthMethodSignInLogs on UserId
)
| project-away UserId1
| where not(isnotempty(SignInLogs_TimeGenerated) and SignInLogs_TimeGenerated > TimeGenerated)
| summarize arg_max(SignInLogs_TimeGenerated, *) by CorrelationId
| extend
ActorPrincipalName = tolower(InitiatedBy.user.userPrincipalName),
TargetUserPrincipalName = tolower(UpdateUser_TargetResources[0].userPrincipalName),
IPAddress = iff(isnotempty(tostring(InitiatedBy.user.ipAddress)), tostring(InitiatedBy.user.ipAddress), SignInLogs_IPAddress),
ModifiedProperty = UpdateUser_TargetResources[0].modifiedProperties
| mv-apply ModifiedProperty on (
summarize BagToUnpack = make_bag(pack(tostring(ModifiedProperty.displayName), pack("oldValue", ModifiedProperty.oldValue, "newValue", ModifiedProperty.newValue)))
)
| extend BagToUnpack = bag_remove_keys(BagToUnpack, set_difference(bag_keys(BagToUnpack), split(trim(@'\"', tostring(BagToUnpack["Included Updated Properties"].newValue)), ", ")))
| evaluate bag_unpack(BagToUnpack, columnsConflict = 'keep_source')
| project-reorder
TimeGenerated,
ActorPrincipalName,
IPAddress,
OperationName,
TargetUserPrincipalName,
Result,
ResultDescription,
Strong*,
SearchableDevice*,
LoggedByService,
InitiatedBy,
UpdateUser_TargetResources,
SecurityInfo_TargetResources,
UserId
//};
//Function(query_period, query_userids, check_signinlogs)