Service principal Conditional Access anomaly

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


This query hunts for successful service principal sign-ins with unexpected Conditional Access outcomes from new source context.

Attribute Value
Type Hunting Query
Solution Hybrid Attack - Cloud & Identity
ID 92076c80-49fd-4af0-9f9d-ea9dd1fa85c6
Tactics DefenseEvasion, Persistence
Techniques T1078.004, T1550.001
Required Connectors AzureActiveDirectory
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AADServicePrincipalSignInLogs ConditionalAccessStatus in "failure,notApplied"
ResultType in "0,Success"

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Hunting Queries · Back to Hybrid Attack - Cloud & Identity