Elastic low stable kql

Entra ID User Sign-in with Unusual Non-Managed Device

Identifies when a Microsoft Entra ID user signs in from a device that is not typically used by the user and is not managed, which may indicate potential compromise or unauthorized access attempts. This rule detects unusual sign-in activity by comparing the device used for the sign-in against the user's typical device usage patterns. Adversaries may create and register a new device to obtain a Primary Refresh Token (PRT) and maintain persistent access.

View Source

Detection Logic

data_stream.dataset: "azure.signinlogs" and
    event.category: "authentication" and
    azure.signinlogs.properties.user_type: "Member" and
    azure.signinlogs.properties.token_protection_status_details.sign_in_session_status: "unbound" and
    not azure.signinlogs.properties.device_detail.is_managed: true and
    not azure.signinlogs.properties.device_detail.device_id: "" and
    not azure.signinlogs.properties.device_detail.trust_type: "Hybrid Azure AD joined" and
    not (azure.signinlogs.category: "NonInteractiveUserSignInLogs" and azure.signinlogs.properties.incoming_token_type: "none") and
    azure.signinlogs.properties.user_principal_name: *

Field Validations

Loading…

Comments (0)

Loading comments...