Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Anomolous Single Factor Signin

Back
Idf7c3f5c8-71ea-49ff-b8b3-148f0e346291
RulenameAnomolous Single Factor Signin
DescriptionDetects successful signins using single factor authentication where the device, location, and ASN are abnormal.

Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess.

Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in
SeverityLow
TacticsInitialAccess
TechniquesT1078.004
Required data connectorsAzureActiveDirectory
KindScheduled
Query frequency1d
Query period7d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/AnomolousSingleFactorSignin.yaml
Version1.0.3
Arm templatef7c3f5c8-71ea-49ff-b8b3-148f0e346291.json
Deploy To Azure
let known_locations = (SigninLogs
  | where TimeGenerated between(ago(7d)..ago(1d))
  | where ResultType == 0
  | extend LocationDetail = strcat(Location, "-", LocationDetails.state)
  | summarize by LocationDetail);
  let known_asn = (SigninLogs
  | where TimeGenerated between(ago(7d)..ago(1d))
  | where ResultType == 0
  | summarize by AutonomousSystemNumber);
  SigninLogs
  | where TimeGenerated > ago(1d)
  | where ResultType == 0
  | where isempty(DeviceDetail.deviceId)
  | where AuthenticationRequirement == "singleFactorAuthentication"
  | extend LocationDetail = strcat(Location, "-", LocationDetails.state)
  | where AutonomousSystemNumber !in (known_asn) and LocationDetail !in (known_locations)
triggerOperator: gt
tactics:
- InitialAccess
queryPeriod: 7d
kind: Scheduled
relevantTechniques:
- T1078.004
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/AnomolousSingleFactorSignin.yaml
queryFrequency: 1d
description: |
  'Detects successful signins using single factor authentication where the device, location, and ASN are abnormal.
    Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess.
    Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'  
requiredDataConnectors:
- dataTypes:
  - SigninLogs
  connectorId: AzureActiveDirectory
version: 1.0.3
tags:
- AADSecOpsGuide
triggerThreshold: 0
severity: Low
metadata:
  author:
    name: Pete Bryan
  categories:
    domains:
    - Security - Others
  source:
    kind: Community
  support:
    tier: Community
id: f7c3f5c8-71ea-49ff-b8b3-148f0e346291
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserPrincipalName
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IPAddress
    identifier: Address
name: Anomolous Single Factor Signin
query: |
  let known_locations = (SigninLogs
    | where TimeGenerated between(ago(7d)..ago(1d))
    | where ResultType == 0
    | extend LocationDetail = strcat(Location, "-", LocationDetails.state)
    | summarize by LocationDetail);
    let known_asn = (SigninLogs
    | where TimeGenerated between(ago(7d)..ago(1d))
    | where ResultType == 0
    | summarize by AutonomousSystemNumber);
    SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == 0
    | where isempty(DeviceDetail.deviceId)
    | where AuthenticationRequirement == "singleFactorAuthentication"
    | extend LocationDetail = strcat(Location, "-", LocationDetails.state)
    | where AutonomousSystemNumber !in (known_asn) and LocationDetail !in (known_locations)  
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f7c3f5c8-71ea-49ff-b8b3-148f0e346291')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f7c3f5c8-71ea-49ff-b8b3-148f0e346291')]",
      "properties": {
        "alertRuleTemplateName": "f7c3f5c8-71ea-49ff-b8b3-148f0e346291",
        "customDetails": null,
        "description": "'Detects successful signins using single factor authentication where the device, location, and ASN are abnormal.\n  Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess.\n  Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in'\n",
        "displayName": "Anomolous Single Factor Signin",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserPrincipalName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/SigninLogs/AnomolousSingleFactorSignin.yaml",
        "query": "let known_locations = (SigninLogs\n  | where TimeGenerated between(ago(7d)..ago(1d))\n  | where ResultType == 0\n  | extend LocationDetail = strcat(Location, \"-\", LocationDetails.state)\n  | summarize by LocationDetail);\n  let known_asn = (SigninLogs\n  | where TimeGenerated between(ago(7d)..ago(1d))\n  | where ResultType == 0\n  | summarize by AutonomousSystemNumber);\n  SigninLogs\n  | where TimeGenerated > ago(1d)\n  | where ResultType == 0\n  | where isempty(DeviceDetail.deviceId)\n  | where AuthenticationRequirement == \"singleFactorAuthentication\"\n  | extend LocationDetail = strcat(Location, \"-\", LocationDetails.state)\n  | where AutonomousSystemNumber !in (known_asn) and LocationDetail !in (known_locations)\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P7D",
        "severity": "Low",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "tags": [
          "AADSecOpsGuide"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}