Service Principal Authentication Attempt from New Country

Back


Id	1baaaf00-655f-4de9-8ff8-312e902cda71
Rulename	Service Principal Authentication Attempt from New Country
Description	Detects when there is a Service Principal login attempt from a country that has not seen a successful login in the previous 14 days. Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts. Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
Severity	Medium
Tactics	InitialAccess
Techniques	T1078.004
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/ServicePrincipalAuthenticationAttemptfromNewCountry.yaml
Version	1.0.1
Arm template	1baaaf00-655f-4de9-8ff8-312e902cda71.json

KQL

let known_locations = (
  AADServicePrincipalSignInLogs
  | where TimeGenerated between(ago(14d)..ago(1d))
  | where ResultType == 0
  | summarize by Location);
  AADServicePrincipalSignInLogs
  | where TimeGenerated > ago(1d)
  | where ResultType != 50126
  | where Location !in (known_locations)
  | extend City = tostring(parse_json(LocationDetails).city)
  | extend State = tostring(parse_json(LocationDetails).state)
  | extend Place = strcat(City, " - ", State)
  | extend Result = strcat(tostring(ResultType), " - ", ResultDescription)
  | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), make_set(Result), make_set(IPAddress), make_set(Place) by ServicePrincipalName, Location

YAML

metadata:
  support:
    tier: Community
  author:
    name: Pete Bryan
  categories:
    domains:
    - Security - Others
    - Identity
  source:
    kind: Community
kind: Scheduled
name: Service Principal Authentication Attempt from New Country
severity: Medium
queryFrequency: 1d
description: |
  'Detects when there is a Service Principal login attempt from a country that has not seen a successful login in the previous 14 days.
    Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts.
    Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
    Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins'  
tags:
- AADSecOpsGuide
queryPeriod: 14d
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ServicePrincipalName
    identifier: Name
id: 1baaaf00-655f-4de9-8ff8-312e902cda71
tactics:
- InitialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/ServicePrincipalAuthenticationAttemptfromNewCountry.yaml
relevantTechniques:
- T1078.004
query: |
  let known_locations = (
    AADServicePrincipalSignInLogs
    | where TimeGenerated between(ago(14d)..ago(1d))
    | where ResultType == 0
    | summarize by Location);
    AADServicePrincipalSignInLogs
    | where TimeGenerated > ago(1d)
    | where ResultType != 50126
    | where Location !in (known_locations)
    | extend City = tostring(parse_json(LocationDetails).city)
    | extend State = tostring(parse_json(LocationDetails).state)
    | extend Place = strcat(City, " - ", State)
    | extend Result = strcat(tostring(ResultType), " - ", ResultDescription)
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), make_set(Result), make_set(IPAddress), make_set(Place) by ServicePrincipalName, Location  
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - AADServicePrincipalSignInLogs
  connectorId: AzureActiveDirectory
version: 1.0.1
triggerThreshold: 0

ARM