Suspicious Sign In by AAD Connect Sync Account

BehaviorAnalytics
// User modification is expected from this account so focus on logons
| where ActivityType =~ "LogOn"
| where UserName startswith "Sync_" and UsersInsights.AccountDisplayName =~ "On-Premises Directory Synchronization Service Account"
// Filter out this expected activity
| where ActivityInsights.App !~ "Microsoft Azure Active Directory Connect"
| where InvestigationPriority > 0
| extend Name = split(UserPrincipalName, "@")[0], UPNSuffix = split(UserPrincipalName, "@")[1]

triggerThreshold: 0
queryFrequency: 1h
relevantTechniques:
- T1078.004
tactics:
- InitialAccess
id: 2cd8b3d5-c9e0-4be3-80f7-0469d511c3f6
alertDetailsOverride:
  alertDescriptionFormat: |
    This query looks for sign ins by the Azure AD Connect Sync account to Azure where properties about the logon are anomalous.
    This query uses Microsoft Sentinel's UEBA features to detect these suspicious properties.
    A threat actor may attempt to steal the Sync account credentials and use them to access Azure resources. This alert should be 
    reviewed to ensure that the log in came was from a legitimate source.
    In this case {{UserPrincipalName}} logged in from {{SourceIPAddress}}.    
  alertDisplayNameFormat: Suspicious Sign In by AAD Connect Sync Account {{UserPrincipalName}} from {{SourceIPAddress}}
kind: Scheduled
triggerOperator: gt
severity: Medium
version: 1.0.0
requiredDataConnectors:
- connectorId: BehaviorAnalytics
  dataTypes:
  - BehaviorAnalytics
query: |
  BehaviorAnalytics
  // User modification is expected from this account so focus on logons
  | where ActivityType =~ "LogOn"
  | where UserName startswith "Sync_" and UsersInsights.AccountDisplayName =~ "On-Premises Directory Synchronization Service Account"
  // Filter out this expected activity
  | where ActivityInsights.App !~ "Microsoft Azure Active Directory Connect"
  | where InvestigationPriority > 0
  | extend Name = split(UserPrincipalName, "@")[0], UPNSuffix = split(UserPrincipalName, "@")[1]  
entityMappings:
- fieldMappings:
  - columnName: Name
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: SourceIPAddress
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: DestinationDevice
    identifier: HostName
  entityType: Host
queryPeriod: 1h
name: Suspicious Sign In by AAD Connect Sync Account
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/BehaviorAnalytics/SuspiciousSigninByAADConnectAccount.yaml
status: Available
description: |
  'This query looks for sign ins by the Azure AD Connect Sync account to Azure where properties about the logon are anomalous.
  This query uses Microsoft Sentinel's UEBA features to detect these suspicious properties.
  A threat actor may attempt to steal the Sync account credentials and use them to access Azure resources. This alert should be 
  reviewed to ensure that the log in came was from a legitimate source.'  

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2cd8b3d5-c9e0-4be3-80f7-0469d511c3f6')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2cd8b3d5-c9e0-4be3-80f7-0469d511c3f6')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Suspicious Sign In by AAD Connect Sync Account",
        "description": "'This query looks for sign ins by the Azure AD Connect Sync account to Azure where properties about the logon are anomalous.\nThis query uses Microsoft Sentinel's UEBA features to detect these suspicious properties.\nA threat actor may attempt to steal the Sync account credentials and use them to access Azure resources. This alert should be \nreviewed to ensure that the log in came was from a legitimate source.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "BehaviorAnalytics\n// User modification is expected from this account so focus on logons\n| where ActivityType =~ \"LogOn\"\n| where UserName startswith \"Sync_\" and UsersInsights.AccountDisplayName =~ \"On-Premises Directory Synchronization Service Account\"\n// Filter out this expected activity\n| where ActivityInsights.App !~ \"Microsoft Azure Active Directory Connect\"\n| where InvestigationPriority > 0\n| extend Name = split(UserPrincipalName, \"@\")[0], UPNSuffix = split(UserPrincipalName, \"@\")[1]\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078.004"
        ],
        "alertRuleTemplateName": "2cd8b3d5-c9e0-4be3-80f7-0469d511c3f6",
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This query looks for sign ins by the Azure AD Connect Sync account to Azure where properties about the logon are anomalous.\nThis query uses Microsoft Sentinel's UEBA features to detect these suspicious properties.\nA threat actor may attempt to steal the Sync account credentials and use them to access Azure resources. This alert should be \nreviewed to ensure that the log in came was from a legitimate source.\nIn this case {{UserPrincipalName}} logged in from {{SourceIPAddress}}.\n",
          "alertDisplayNameFormat": "Suspicious Sign In by AAD Connect Sync Account {{UserPrincipalName}} from {{SourceIPAddress}}"
        },
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "Name",
                "identifier": "Name"
              },
              {
                "columnName": "UPNSuffix",
                "identifier": "UPNSuffix"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "columnName": "SourceIPAddress",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          },
          {
            "fieldMappings": [
              {
                "columnName": "DestinationDevice",
                "identifier": "HostName"
              }
            ],
            "entityType": "Host"
          }
        ],
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/BehaviorAnalytics/SuspiciousSigninByAADConnectAccount.yaml",
        "status": "Available"
      }
    }
  ]
}