StealthTalk - Multi new devices registration | Microsoft Sentinel Analytic Rules

Back


Id	f9d4c2a8-1b6e-4a3f-9c7d-8e2b1a3c5d7e
Rulename	StealthTalk - Multi new devices registration
Description	Identifies a single StealthTalk user registering two or more previously-unseen devices within a 24-hour window. Sudden registration of multiple new devices is a strong indicator of account takeover (an attacker enrolling their own device after credential theft) or device-farm abuse. The rule fires when a user produces two or more distinct NewDeviceId values within the lookback window, regardless of operating system. Look at the OSList custom detail to spot cross-platform patterns (e.g. an iOS-only user suddenly enrolling an Android device).
Severity	Medium
Tactics	Persistence InitialAccess DefenseEvasion
Techniques	T1078 T1098
Required data connectors	StealthTalkAnomalousAuth
Kind	Scheduled
Query frequency	30m
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/MultiNewDevicesRegistration.yaml
Version	1.0.0
Arm template	f9d4c2a8-1b6e-4a3f-9c7d-8e2b1a3c5d7e.json

KQL

let LookbackPeriod = 24h;
let MinNewDevices  = 2;
StealthTalkAnomalousAuth_CL
| where TimeGenerated >= ago(LookbackPeriod)
| where EventType == "NewDeviceLogin"
| summarize
    NewDeviceCount  = dcount(NewDeviceId),
    NewDevices      = make_set(NewDeviceId),
    NewDeviceOSList = make_set(NewDeviceOS),
    FirstSeen       = min(TimeGenerated),
    LastSeen        = max(TimeGenerated),
    AppVersions     = make_set(AppVersion)
  by UserId
| where NewDeviceCount >= MinNewDevices
| extend
    AlertName    = "MultiNewDevicesRegistration",
    AlertDetails = strcat(
        "User ", UserId,
        " registered ", NewDeviceCount, " new devices within 24 hours.",
        " Device IDs: ", tostring(NewDevices), ".",
        " Operating systems: ", tostring(NewDeviceOSList), "."
    )
| project
    TimeGenerated = LastSeen,
    UserId, NewDeviceCount, NewDevices, NewDeviceOSList,
    FirstSeen, LastSeen, AppVersions, AlertName, AlertDetails

YAML

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByEntities:
    - Account
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
    lookbackDuration: 5h
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserId
    identifier: Name
query: |
  let LookbackPeriod = 24h;
  let MinNewDevices  = 2;
  StealthTalkAnomalousAuth_CL
  | where TimeGenerated >= ago(LookbackPeriod)
  | where EventType == "NewDeviceLogin"
  | summarize
      NewDeviceCount  = dcount(NewDeviceId),
      NewDevices      = make_set(NewDeviceId),
      NewDeviceOSList = make_set(NewDeviceOS),
      FirstSeen       = min(TimeGenerated),
      LastSeen        = max(TimeGenerated),
      AppVersions     = make_set(AppVersion)
    by UserId
  | where NewDeviceCount >= MinNewDevices
  | extend
      AlertName    = "MultiNewDevicesRegistration",
      AlertDetails = strcat(
          "User ", UserId,
          " registered ", NewDeviceCount, " new devices within 24 hours.",
          " Device IDs: ", tostring(NewDevices), ".",
          " Operating systems: ", tostring(NewDeviceOSList), "."
      )
  | project
      TimeGenerated = LastSeen,
      UserId, NewDeviceCount, NewDevices, NewDeviceOSList,
      FirstSeen, LastSeen, AppVersions, AlertName, AlertDetails
suppressionEnabled: false
id: f9d4c2a8-1b6e-4a3f-9c7d-8e2b1a3c5d7e
queryFrequency: 30m
alertDetailsOverride:
  alertDisplayNameFormat: 'StealthTalk: Multi New Devices - {{UserId}} ({{NewDeviceCount}} new devices)'
  alertDescriptionFormat: '{{AlertDetails}}'
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/MultiNewDevicesRegistration.yaml
suppressionDuration: 5h
version: 1.0.0
severity: Medium
relevantTechniques:
- T1078
- T1098
name: StealthTalk - Multi new devices registration
kind: Scheduled
tactics:
- Persistence
- InitialAccess
- DefenseEvasion
requiredDataConnectors:
- dataTypes:
  - StealthTalkAnomalousAuth_CL
  connectorId: StealthTalkAnomalousAuth
description: |
  Identifies a single StealthTalk user registering two or more previously-unseen devices within
  a 24-hour window. Sudden registration of multiple new devices is a strong indicator of
  account takeover (an attacker enrolling their own device after credential theft) or
  device-farm abuse.

  The rule fires when a user produces two or more distinct NewDeviceId values within the
  lookback window, regardless of operating system. Look at the OSList custom detail to spot
  cross-platform patterns (e.g. an iOS-only user suddenly enrolling an Android device).
customDetails:
  NewDeviceOSList: NewDeviceOSList
  NewDevices: NewDevices
  NewDeviceCount: NewDeviceCount
  LastSeen: LastSeen
  FirstSeen: FirstSeen
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 1d

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f9d4c2a8-1b6e-4a3f-9c7d-8e2b1a3c5d7e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f9d4c2a8-1b6e-4a3f-9c7d-8e2b1a3c5d7e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{AlertDetails}}",
          "alertDisplayNameFormat": "StealthTalk: Multi New Devices - {{UserId}} ({{NewDeviceCount}} new devices)"
        },
        "alertRuleTemplateName": "f9d4c2a8-1b6e-4a3f-9c7d-8e2b1a3c5d7e",
        "customDetails": {
          "FirstSeen": "FirstSeen",
          "LastSeen": "LastSeen",
          "NewDeviceCount": "NewDeviceCount",
          "NewDeviceOSList": "NewDeviceOSList",
          "NewDevices": "NewDevices"
        },
        "description": "Identifies a single StealthTalk user registering two or more previously-unseen devices within\na 24-hour window. Sudden registration of multiple new devices is a strong indicator of\naccount takeover (an attacker enrolling their own device after credential theft) or\ndevice-farm abuse.\n\nThe rule fires when a user produces two or more distinct NewDeviceId values within the\nlookback window, regardless of operating system. Look at the OSList custom detail to spot\ncross-platform patterns (e.g. an iOS-only user suddenly enrolling an Android device).\n",
        "displayName": "StealthTalk - Multi new devices registration",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserId",
                "identifier": "Name"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "PT5H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/StealthTalk/Analytic%20Rules/MultiNewDevicesRegistration.yaml",
        "query": "let LookbackPeriod = 24h;\nlet MinNewDevices  = 2;\nStealthTalkAnomalousAuth_CL\n| where TimeGenerated >= ago(LookbackPeriod)\n| where EventType == \"NewDeviceLogin\"\n| summarize\n    NewDeviceCount  = dcount(NewDeviceId),\n    NewDevices      = make_set(NewDeviceId),\n    NewDeviceOSList = make_set(NewDeviceOS),\n    FirstSeen       = min(TimeGenerated),\n    LastSeen        = max(TimeGenerated),\n    AppVersions     = make_set(AppVersion)\n  by UserId\n| where NewDeviceCount >= MinNewDevices\n| extend\n    AlertName    = \"MultiNewDevicesRegistration\",\n    AlertDetails = strcat(\n        \"User \", UserId,\n        \" registered \", NewDeviceCount, \" new devices within 24 hours.\",\n        \" Device IDs: \", tostring(NewDevices), \".\",\n        \" Operating systems: \", tostring(NewDeviceOSList), \".\"\n    )\n| project\n    TimeGenerated = LastSeen,\n    UserId, NewDeviceCount, NewDevices, NewDeviceOSList,\n    FirstSeen, LastSeen, AppVersions, AlertName, AlertDetails\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "InitialAccess",
          "Persistence"
        ],
        "techniques": [
          "T1078",
          "T1098"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}