Bert-Jan Pals unknown stable kql

List the top 10 accounts that have the most impersonators

This query lists the top 10 accounts that have performed the most imporsonated users. The definiation for this field is: Indicates whether the activity was performed by one user for another (impersonated) user.

View Source

Detection Logic

CloudAppEvents
| where IsImpersonated == 1
| extend
     MailboxOwnerUPN = tostring(parse_json(RawEventData).MailboxOwnerUPN),
     ActionPerformedBy = tostring(parse_json(RawEventData).UserId)
| where MailboxOwnerUPN != ActionPerformedBy
| summarize Impersonators = make_set(ActionPerformedBy) by MailboxOwnerUPN
| extend TotalImpersonators = array_length(Impersonators)
| top 10 by TotalImpersonators

Field Validations

Loading…

Comments (0)

Loading comments...