Tracking Privileged Account Rare Activity

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


This query determines rare activity by a high-value account on a system or service. If any account with rare activity is found, the query retrieves related activity from that account on the same day and summarizes the information.

Attribute Value
Type Hunting Query
Solution Standalone Content
ID 431cccd3-2dff-46ee-b34b-61933e45f556
Tactics PrivilegeEscalation, Discovery
Techniques T1078, T1087
Required Connectors AzureActiveDirectory, Office365, AWS, SecurityEvents, AzureMonitor(IIS)
Source [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/MultipleDataSources/TrackingPrivAccounts.yaml)

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AWSCloudTrail ✓ ✓ ✓
Event ✓ ✓ ✗
OfficeActivity ✓ ✗ ✓
SecurityAlert ✓ ✗ ✓
SecurityEvent EventID in "4624,4625,4720,4726,4728,4732,4756,7045" ✓ ✓ ✓
SigninLogs ✓ ✗ ✓
W3CIISLog ✓ ✗ ✗

Associated Connectors

The following connectors provide data for this content item:

Connector Solution
AWS Amazon Web Services
AzureActiveDirectory Microsoft Entra ID
ESI-Opt34DomainControllersSecurityEventLogs Microsoft Exchange Security - Exchange On-Premises
ESI-Opt5ExchangeIISLogs Microsoft Exchange Security - Exchange On-Premises
SecurityEvents Windows Security Events
WindowsSecurityEvents Windows Security Events

Solutions: Amazon Web Services, Microsoft Entra ID, Microsoft Exchange Security - Exchange On-Premises, Windows Security Events


Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries