Suspicious Activity on High Blast Radius Account Pre/Post Password Reset
This rule detects suspicious activity on high blast radius accounts, specifically correlating failed authentication attempts, password resets, and successful logons outside business hours. The rule prioritizes detection based on a password reset event to produce an informational severity alert, then looks for preceding failed authentications and subsequent out-of-hours logons to indicate a potential compromise by raising severity accordingly. You will need to utilise the AlertSeverityOverride configuration, pointed at the AlertSeverity field, in your Sentinel rule metaconfig to use this detection effectively. Hard requirement: Need UEBA enabled in your tenant to populate the BlastRadius field in your IdentityInfo table. Change each stage to suit your log source for the behaviour mapped to this stage. Add in other stages if needed to add more dynamic severity (e.g., Account has high blast radius AND is a GA AND was logged in to from outside of expected geolocation > Critical severity)
Microsoft Sentinel (KQL)
