Add hunting queries: Entra privileged-identity utilization pack (3 queries) - #14813
Open
d4rk-pri0r wants to merge 2 commits into
Open
Add hunting queries: Entra privileged-identity utilization pack (3 queries)#14813d4rk-pri0r wants to merge 2 commits into
d4rk-pri0r wants to merge 2 commits into
Conversation
New SigninLogs hunting queries that surface licensed-but-minimally- configured identity gaps in Microsoft Entra ID: - DormantPrivilegedIdentities: enabled identities with directory or PIM roles that have no successful sign-in in 90 days - PrivilegedSigninsWithoutConditionalAccessSuccess: privileged users whose successful logons are not gated by an applied Conditional Access policy - PrivilegedAccountsUsingLegacyAuthentication: privileged users authenticating via legacy protocols that bypass modern CA/MFA All three join IdentityInfo (Microsoft 365 Defender) with SigninLogs and map Account/IP entities.
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds three new Microsoft Entra ID SigninLogs hunting queries focused on identifying privileged identities showing risky/absent usage patterns in “licensed but minimally configured” tenants.
Changes:
- Added a query to find privileged sign-ins where Conditional Access did not succeed.
- Added a query to detect privileged accounts authenticating via legacy protocols.
- Added a query to surface privileged identities with no recent successful sign-ins.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 11 comments.
| File | Description |
|---|---|
| Hunting Queries/SigninLogs/PrivilegedSigninsWithoutConditionalAccessSuccess.yaml | New hunting query for privileged successful sign-ins lacking CA “success”. |
| Hunting Queries/SigninLogs/PrivilegedAccountsUsingLegacyAuthentication.yaml | New hunting query for privileged successful sign-ins using legacy client protocols. |
| Hunting Queries/SigninLogs/DormantPrivilegedIdentities.yaml | New hunting query for enabled privileged identities with no recent successful sign-ins. |
Comment on lines
+33
to
+43
| let lookback = 90d; | ||
| let noSigninSince = 1d; | ||
| IdentityInfo | ||
| | where IsAccountEnabled == true | ||
| | where isnotempty(AssignedRoles) or isnotempty(PrivilegedEntraPimRoles) | ||
| | join kind=leftanti ( | ||
| SigninLogs | ||
| | where TimeGenerated > ago(noSigninSince) | ||
| | where ResultType == "0" | ||
| | project AccountObjectId = UserId | ||
| ) on AccountObjectId |
Comment on lines
+52
to
+60
| entityMappings: | ||
| - entityType: Account | ||
| fieldMappings: | ||
| - identifier: FullName | ||
| columnName: AccountUpn | ||
| - identifier: Name | ||
| columnName: AccountName | ||
| - identifier: UPNSuffix | ||
| columnName: AccountUPNSuffix |
Comment on lines
+42
to
+43
| | where isnotempty(ConditionalAccessStatus) | ||
| | where ConditionalAccessStatus !~ "success" |
Comment on lines
+36
to
+38
| let PrivilegedUsers = IdentityInfo | ||
| | where isnotempty(AssignedRoles) or isnotempty(PrivilegedEntraPimRoles) | ||
| | project AccountObjectId, AccountUpn; |
| | where ResultType == "0" | ||
| | where isnotempty(ConditionalAccessStatus) | ||
| | where ConditionalAccessStatus !~ "success" | ||
| | join kind=inner PrivilegedUsers on $left.UserId == $right.AccountObjectId |
Comment on lines
+38
to
+41
| let LegacyProtocols = dynamic([ | ||
| "IMAP", "POP", "SMTP", "ActiveSync", "ExchangeWebServices", | ||
| "Autodiscover", "OWA" | ||
| ]); |
| SigninLogs | ||
| | where TimeGenerated > ago(timeframe) | ||
| | where ResultType == "0" | ||
| | where ClientAppUsed has_any (LegacyProtocols) |
Comment on lines
+42
to
+44
| let PrivilegedUsers = IdentityInfo | ||
| | where isnotempty(AssignedRoles) or isnotempty(PrivilegedEntraPimRoles) | ||
| | project AccountObjectId, AccountUpn; |
| | where TimeGenerated > ago(timeframe) | ||
| | where ResultType == "0" | ||
| | where ClientAppUsed has_any (LegacyProtocols) | ||
| | join kind=inner PrivilegedUsers on $left.UserId == $right.AccountObjectId |
Comment on lines
+59
to
+61
| IPAddresses = make_set(IPAddress) | ||
| by UserPrincipalName, AccountName, AccountUPNSuffix, UserId, AccountUpn, AppDisplayName | ||
| | extend FirstIP = tostring(IPAddresses[0]) |
Collaborator
|
Hi @d4rk-pri0r, Please review the suggestions above and make the necessary changes accordingly. Also, please confirm that all queries are working correctly in your environment. If possible, share screenshots of the queries running successfully for verification. Thanks |
Contributor
Author
|
Addressed the Copilot review feedback across all three queries (v1.0.1): DormantPrivilegedIdentities
PrivilegedSigninsWithoutConditionalAccessSuccess
PrivilegedAccountsUsingLegacyAuthentication
CI was green on the prior revision; this is description/KQL hardening only. I do not have a live tenant screenshot handy for this environment — happy to add one if you still need visual confirmation after CI re-runs. |
Fix dormant lookback (use 90d), dedupe IdentityInfo, add AadUserId, include null CA status, align legacy ClientAppUsed values with repo patterns, and pick LastIP via arg_max for stable entity mapping.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
Three new SigninLogs hunting queries under the "licensed but minimally configured" theme, surfacing identities that hold directory or PIM roles yet show risky/absent usage patterns in Microsoft Entra ID:
AssignedRolesorPrivilegedEntraPimRolesthat have no successful sign-in in 90 days (blast radius ranked), a classic takeover target and unused-license signal.ConditionalAccessStatuswas notsuccess, i.e. logons reaching the tenant that were not gated by an applied Conditional Access policy.All three join
IdentityInfo(Microsoft 365 Defender) withSigninLogsand map Account and IP entities.Testing
kql-validations(runs on this PR).Note to reviewers
Author metadata:
d4rk-pri0r, Community support tier. If any column name is rejected by KQL validation, I'll patch the affected query.