Elastic medium stable kql

Entra ID OAuth user_impersonation Scope for Unusual User and Client

Identifies rare occurrences of OAuth workflow for a user principal that is single factor authenticated, with an OAuth scope containing user_impersonation for a token issued by Entra ID. Adversaries may use this scope to gain unauthorized access to user accounts, particularly when the sign-in session status is unbound, indicating that the session is not associated with a specific device or session. This behavior is indicative of potential account compromise or unauthorized access attempts. This rule flags when this pattern is detected for a user principal that has not been seen in the last 10 days, indicating potential abuse or unusual activity.

View Source

Detection Logic

data_stream.dataset:azure.signinlogs and
azure.signinlogs.properties.authentication_processing_details:(*user_impersonation* and not *restricted_user_impersonation*) and
azure.signinlogs.properties.authentication_requirement:singleFactorAuthentication and
azure.signinlogs.properties.token_issuer_type:AzureAD and
azure.signinlogs.properties.token_protection_status_details.sign_in_session_status:unbound and
azure.signinlogs.properties.user_type:Member and
azure.signinlogs.properties.conditional_access_status:"notApplied" and
not user_agent.original:(Microsoft*Authentication*iPhone* or Mozilla*PKeyAuth/1.0) and
not azure.signinlogs.properties.device_detail.operating_system:(Android* or Ios*) and
event.outcome:success and
not azure.signinlogs.properties.app_id:(
    0000000c-0000-0000-c000-000000000000 or
    0a5f63c0-b750-4f38-a71c-4fc0d58b89e2 or
    48af08dc-f6d2-435f-b2a7-069abd99c086 or
    5e3ce6c0-2b1f-4285-8d4b-75ee78787346 or
    65d91a3d-ab74-42e6-8a2f-0add61688c74 or
    66a88757-258c-4c72-893c-3e8bed4d6899 or
    6bc3b958-689b-49f5-9006-36d165f30e00 or
    8c59ead7-d703-4a27-9e55-c96a0054c8d2 or
    95de633a-083e-42f5-b444-a4295d8e9314 or
    ab9b8c07-8f02-4f72-87fa-80105867a763 or
    cc15fd57-2c6c-4117-a88c-83b1d56b4bbe or
    d52792f4-ba38-424d-8140-ada5b883f293 or
    e8be65d6-d430-4289-a665-51bf2a194bda or
    fc0f3af4-6835-4174-b806-f7db311fd2f3
) and
not (
    azure.signinlogs.properties.resource_id:c2ada927-a9e2-4564-aae2-70775a2fa0af and
    (
        azure.signinlogs.properties.app_id:00000002-0000-0ff1-ce00-000000000000 and
        azure.signinlogs.properties.device_detail.operating_system:Windows or
        azure.signinlogs.properties.app_id:5f00fd34-f302-417f-81ef-1adda179d8fd and
        azure.signinlogs.properties.device_detail.operating_system:Windows*
    ) and
    azure.signinlogs.properties.device_detail.is_managed:true and
    azure.signinlogs.properties.device_detail.is_compliant:true and
    azure.signinlogs.properties.device_detail.trust_type:("Azure AD joined" or "Hybrid Azure AD joined") and
    azure.signinlogs.properties.device_detail.device_id:(* and not "") and
    azure.signinlogs.properties.incoming_token_type:none and
    azure.signinlogs.properties.client_app_used:Browser and
    azure.signinlogs.category:NonInteractiveUserSignInLogs
)

Field Validations

Loading…

Comments (0)

Loading comments...