Elastic high stable eql

Entra ID Protection User Alert and Device Registration

Identifies sequence of events where a Microsoft Entra ID protection alert is followed by an attempt to register a new device by the same user principal. This behavior may indicate an adversary using a compromised account to register a device, potentially leading to unauthorized access to resources or persistence in the environment.

View Source

Detection Logic

sequence with maxspan=5m
[any where data_stream.dataset == "azure.identity_protection"] by azure.identityprotection.properties.user_principal_name
[any where data_stream.dataset == "azure.auditlogs" and event.action == "Register device"] by azure.auditlogs.properties.initiated_by.user.userPrincipalName

Field Validations

Loading…

Comments (0)

Loading comments...