Unauthorized Member Action on RiskyUsers - Correlated
Correlates AuditLogs and IdentityInfo on AccountUPN to detect unauthorized CA or GA members performing IdentityProtection actions on RiskyUsers in Azure Entra ID outside of the Information Security department. Note: The following logic is NOT expressible in Sigma and must be applied post-conversion in native KQL: - Multiple join fallback matching (by UPN, last name, full name) - StrippedAdminName prefix removal (CA - / GA - ) - summarize arg_max(TimeGenerated, *) by AccountUPN - iff() fallback logic for department and job title - sort by TimeGenerated desc - project-reorder
Sigma
