Sagar Patel
@sagarCompletionist
2 followers26 downloads271 copies0 likes3,308 views
9 detections
Filters
Last updated
All Time
Detection languages
8
1
Categories
3
3
3
2
2
Platforms
2
1
1
Products / Services
2
1
1
MITRE Techniques
5
3
2
2
2
CVEs
1
IDS Classtypes
1
IDS Protocols
2
Detects possible MFA-approved session replay by identifying abnormal reuse of authenticated sessions across multiple IPs, browsers, and devices compared against a 14-day historical baseline. The rule prioritizes browser/device anomalies over geography since modern attackers often use same-country VPS/proxies.
Detects possible Adversary-in-the-Middle (AiTM) attacks, session cookie replay, MFA session hijacking, token theft, and stolen cloud session reuse by identifying abnormal SessionId reuse across multiple IPs, browsers, and devices. This detection compares current session activity against a 14-day historical user behavior baseline to identify new or abnormal behavior. It includes risk scoring and account classification, while reducing false positives from token refresh activity and common Microsoft Teams noise.
Detects AiTM compromise where user click phishing URL, completed MFA, and signed in from a different IP within 10 minutes
This query identifies rare or newly observed application sign-ins by comparing activity in the last 24 hours against a 30‑day historical baseline.
It highlights applications that are never used or seldom used in the tenant, helping detect anomalous or suspicious application activity that may indicate OAuth abuse, automation tools, or compromised accounts.
It highlights applications that are never used or seldom used in the tenant, helping detect anomalous or suspicious application activity that may indicate OAuth abuse, automation tools, or compromised accounts.
The purpose of this query is to identify accounts that have logged in from multiple different countries within a short time window (last hour or last day).
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This query retrieves the most recent record for each device and filters the results to show devices that are currently isolated.
• The DeviceInfo table contains details about each device and its status over time.
• The summarize arg_max(Timestamp, *) by DeviceName part selects the latest entry (based on Timestamp) for every device.
• The where MitigationStatus contains "Isolated" filter ensures that only devices with an isolation-related mitigation status are displayed.
• The DeviceInfo table contains details about each device and its status over time.
• The summarize arg_max(Timestamp, *) by DeviceName part selects the latest entry (based on Timestamp) for every device.
• The where MitigationStatus contains "Isolated" filter ensures that only devices with an isolation-related mitigation status are displayed.
This query analyzes login events to identify users with more than five failed login attempts. It filters for login-related events, groups the data by username, endpoint name, failure reason, login type, and associated indicators, then counts the number of failed attempts. The results are sorted in descending order of failed attempts to highlight potentially suspicious activity.
Detect unauthorized access by identifying new country sign-ins for users through AADSignInEventsBeta analytics.
This query helps identify user accounts that faced logon failures due to expired passwords by correlating logon failure events with the last password change timestamp using Microsoft Entra ID and IdentityLogonEvents.