Platform
Entra ID
9 queries tagged with this platform.
-
Analytics Rules
Detect Oauth Token Used From Novel Country
OAuth token used from a country the user has never signed in from — ToddyCat/Umbrij downstream shape where the token itself is the payload.
-
Analytics Rules / Failed Logins
Failed Login Attempts
3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.
-
Analytics Rules / Password Spray
Detect Low And Slow Password Spray
Low-and-slow spray pattern (Storm-0940-shaped): many unique users from the *same* IP in a day, with roughly one failed attempt per user; includes optional legacy-user-agent hints.
-
Analytics Rules / Password Spray
Detect Wide Low Volume Password Sprays
Wide, low-volume spray: from a single IP, exactly one failed attempt per user in a day, but against many different users.
-
Hunting
Hunt Credential Compromise Signin Audit Alert Three Table
Three-table credential-compromise chain: joins risky sign-ins, audit follow-up, and downstream SecurityAlert on the same user.
-
Hunting
Hunt Suspicious User Consented Oauth App Grants
'The backdoor you approved yourself' — OAuth application consents granting broad Graph permissions to unfamiliar apps. Focuses on CONSENT events, not the logins that follow.
-
Hunting
Hunt Teams Phishing Then Suspicious Login Correlation
Teams phishing messages correlated with subsequent suspicious sign-ins for the same recipient — deals with ExternalAccess not being populated by falling back to sender-domain-outside-org.
-
Hunting / User Activity
Whats This User Doing
Unions `DeviceEvents`, `DeviceNetworkEvents`, and `DeviceFileEvents` to give a timestamped activity trace for a single user, including URLs touched. Swiss-army knife for user investigations — includes a Facebook-usage example.
-
Identity
Whos Activating Roles Via PIM
PIM role activations from `AuditLogs` — useful for tracking privileged-role usage.