High risk Office operation conducted by IP Address that recently attempted to log into a disabled account

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


'It is possible that a disabled user account is compromised and another account on the same IP is used to perform operations that are not typical for that user. The query filters the SigninLogs for entries where ResultType is indicates a disabled account and the TimeGenerated is within a defined time range. It then summarizes these entries by IPAddress and AppId, calculating various statistics such as number of login attempts, distinct UPNs, App IDs etc and joins these results with another set

Attribute Value
Type Analytic Rule
Solution Standalone Content
ID 9adbd1c3-a4be-44ef-ac2f-503fd25692ee
Severity Medium
Kind Scheduled
Tactics InitialAccess, Persistence, Collection
Techniques T1078, T1098, T1114
Required Connectors AzureActiveDirectory, Office365
Source View on GitHub

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules