Inactive or new account signins

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Query for new sign-ins from stale/inactive accounts. UEBA filters based on ActivityInsights. Results for accounts created in the last 7 days are filtered out.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	847c2652-547d-4d5f-9b71-d2f8d81eac62
Tactics	InitialAccess
Techniques	T1078
Required Connectors	AzureActiveDirectory, BehaviorAnalytics
Source	[View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/SigninLogs/InactiveAccounts.yaml)

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries