Elastic medium stable kql

Azure AD Graph Access with Unusual User and ASN

Identifies Azure AD Graph (graph.windows.net) requests originating from network sources outside the major public-cloud and Microsoft ASNs that legitimate first-party callers normally come from. Adversary tooling typically rides on commodity hosting (residential ISPs, VPS providers, anonymisers) which produces an ASN distribution very different from the Microsoft / AWS / GCP / Akamai / Cloudflare ranges that dominate legitimate AAD Graph traffic.

View Source

Detection Logic

data_stream.dataset:azure.aadgraphactivitylogs and
    user.id:* and source.as.number:(* and
        not (
            3598 or 7224 or 8068 or 8069 or 8070 or
            8071 or 8072 or 8073 or 8074 or 8075 or
            8987 or 12076 or 14618 or 15169 or 16509 or
            19527 or 36040 or 36384 or 36385 or 36492 or
            39111 or 394089 or 396982
        )
    )

False Positives

  • ⚠ Users calling AAD Graph from corporate office networks or home ISPs with custom tooling. Tune the excluded ASN organisation list to your environment.
  • ⚠ Cloud-hosted internal automation running outside the major providers (smaller cloud or colo). Add exceptions on the calling user or app ID after validation.

Field Validations

Loading…

Comments (0)

Loading comments...