It appears the content you've provided is a detailed guide for validating security detection rules within Microsoft Sentinel, specifically focusing on detecting suspicious activities related to non-interactive sign-ins and directory changes in Azure AD. Below, I'll summarize key points from each section of your document:
Rule 1 — Non-Interactive Sign-In with Sensitive Directory Change
Objective: Detect a successful non-interactive authentication followed by one of four sensitive directory changes within 30 minutes.
Settings:
- Severity: Medium
- Run every: 5 minutes
- Look back: 30 minutes
- Initial state: Disabled until validated
- MITRE ATT&CK: T1550.001 (Application Access Token)
Trigger Condition: An authentication event with a populated UserPrincipalName followed by one of four specific directory changes within the same time frame.
Lab Trigger: Simulate an authentication and then perform sensitive operations like adding applications or service principals to validate if the rule triggers correctly.
Detection KQL & Validation Query:
Queries are provided for both detection and validation purposes, focusing on identifying relevant events in AADNonInteractiveUserSignInLogs and AuditLogs.
Rule 2 — Same En
Read the full article at InfoSec Write-ups - Medium
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
