Securityalert Summarizesigninsaftermailboxrule

KQL detection rule by reprise99 · MIT

When Defender for Cloud Apps detects a suspicious mailbox rule created, take that IP address and summarize sign in events for that user and IP address for the last 30 days.

//When Defender for Cloud Apps detects a suspicious mailbox rule created, take that IP address and summarize sign in events for that user and IP address for the last 30 days.

//Data connector required for this query - Security Alert (free table that other Defender products send alert info to)
//Data connector required for this query - Azure Active Directory - Signin Logs

//If they have only signed in a few times from that IP it may a sign the account has been compromised and a threat actor has added mailbox rule
let failureCodes = dynamic([50053, 50126, 50055]);
let successCodes = dynamic([0, 50055, 50057, 50155, 50105, 50133, 50005, 50076, 50079, 50173, 50158, 50072, 50074, 53003, 53000, 53001, 50129]);
SecurityAlert
| where TimeGenerated > ago(1d)
| where AlertName == "Suspicious inbox manipulation rule"
| extend IPAddress = tostring(parse_json(ExtendedProperties).["IP Addresses"])
| project ['Alert Time']=TimeGenerated, Description, IPAddress, UserPrincipalName=CompromisedEntity
| join kind=inner(
    SigninLogs
    | where TimeGenerated > ago (30d)
    )
    on UserPrincipalName, IPAddress
| project
    TimeGenerated,
    ['Alert Time'],
    Description,
    ResultType,
    UserPrincipalName,
    IPAddress,
    NetworkLocationDetails
| summarize
    ['Count of successful sign ins from MFA IP Address'] = countif(ResultType in(successCodes)),
    ['Count of failed sign ins from MFA IP Address'] = countif(ResultType in(failureCodes))
    by UserPrincipalName, Description, IPAddress, NetworkLocationDetails, ['Alert Time']

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

057971d0-dca9-45db-94c8-298cf0aa579e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion