Elastic medium stable kql

M365 Identity Login from Atypical Region

Detects successful Microsoft 365 portal logins from a country and region the user has not previously authenticated from in a specific time window. Atypical regions are identified by combining the user's country and region geolocation history; an authentication from a new country/region pair for that user may indicate an adversary attempting to access the account from an unusual location or behind a VPN.

View Source

Detection Logic

data_stream.dataset:o365.audit and 
    event.provider:AzureActiveDirectory and
    event.action:UserLoggedIn and event.outcome:success and
    o365.audit.Target.Type:(0 or 2 or 3 or 5 or 6 or 10) and
    o365.audit.UserId:(* and not "Not Available") and
    source.geo.country_name:* and
    source.geo.region_name:* and
    o365.audit.ApplicationId:(* and not (
        08e18876-6177-487e-b8b5-cf950c1e598c or
        29d9ed98-a469-4536-ade2-f981bc1d605e or
        38aa3b87-a06d-4817-b275-7a316988d93b or
        3e62f81e-590b-425b-9531-cad6683656cf or
        a809996b-059e-42e2-9866-db24b99a9782 or
        d7b530a4-7680-4c23-a8bf-c52c121d2e87
    )) and
    o365.audit.ExtendedProperties.RequestType:(* and not (
        "Consent:Set" or
        "DeviceAuth:ReprocessTls" or
        "Federation:oauth2claimsprovider" or
        "Federation:oauth2msa" or
        "Kmsi:kmsi" or
        "Login:reprocess" or
        "Login:resume" or
        "MessagePrompt:MessagePrompt" or
        "OrgIdWsFederation:federation" or 
        "PermitSso:PermitSso" or
        "SAS:EndAuth" or
        "SAS:ProcessAuth" or
        "SSPR:end" or
        "Saml2:processrequest" or
        "WsFederation:wsfederation"
    )) and
    not user_agent.original:(*Android* or *PKeyAuth* or *WebView* or *iPad* or *iPhone*)

False Positives

  • ⚠ False positives may occur when users are using a VPN or when users are traveling to different locations"
  • ⚠ Mobile access may also result in false positives, as users may log in from various locations while on the go.

Field Validations

Loading…

Comments (0)

Loading comments...