Data Source
SigninLogs
8 queries tagged with this data source.
-
Analytics Rules
Detect Oauth Token Used From Novel Country
OAuth token used from a country the user has never signed in from — ToddyCat/Umbrij downstream shape where the token itself is the payload.
-
Analytics Rules
Detect Smartconnect Session Without Signin
Microsoft SmartConnect (CVE-2026-55040) sessions lacking a corresponding sign-in event — absence-detection with windowed leftouter + countif.
-
Analytics Rules / Failed Logins
Failed Login Attempts
3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.
-
Analytics Rules / Password Spray
Detect Low And Slow Password Spray
Low-and-slow spray pattern (Storm-0940-shaped): many unique users from the *same* IP in a day, with roughly one failed attempt per user; includes optional legacy-user-agent hints.
-
Analytics Rules / Password Spray
Detect Wide Low Volume Password Sprays
Wide, low-volume spray: from a single IP, exactly one failed attempt per user in a day, but against many different users.
-
Hunting
Hunt Credential Compromise Signin Audit Alert Three Table
Three-table credential-compromise chain: joins risky sign-ins, audit follow-up, and downstream SecurityAlert on the same user.
-
Hunting
Hunt Teams Phishing Then Suspicious Login Correlation
Teams phishing messages correlated with subsequent suspicious sign-ins for the same recipient — deals with ExternalAccess not being populated by falling back to sender-domain-outside-org.
-
Hunting / User Activity
Whats This User Doing
Unions `DeviceEvents`, `DeviceNetworkEvents`, and `DeviceFileEvents` to give a timestamped activity trace for a single user, including URLs touched. Swiss-army knife for user investigations — includes a Facebook-usage example.