Skip to content

Instantly share code, notes, and snippets.

@JohnLaTwC
Created May 7, 2019 16:58
Show Gist options
  • Star 7 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save JohnLaTwC/5eb27b85960f830b6f557fa6ccc43be5 to your computer and use it in GitHub Desktop.
Save JohnLaTwC/5eb27b85960f830b6f557fa6ccc43be5 to your computer and use it in GitHub Desktop.
Azure Sentinel Password spray query
let valid_logons = (OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation == 'UserLoggedIn'
| summarize by ClientIP);
let only_invalid_logons = (OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation == 'UserLoginFailed'
| summarize by ClientIP)
| join kind=anti (valid_logons) on ClientIP;
OfficeActivity
| where TimeGenerated > ago(30d)
| join kind=inner (only_invalid_logons) on ClientIP
| extend UserAgent=tostring(parse_json(ExtendedProperties)[0].Value)
| where (UserAgent matches regex 'Microsoft Office/\\d+\\.\\d+ \\(Windows NT \\d+\\.\\d+; Microsoft Outlook \\d+\\.\\d+\\.\\d+; Pro\\)'
or UserAgent == 'CBAInPROD'
or UserAgent matches regex '^[\\w\\.\\d\\-\\_]{4,15}\\/[\\.\\w\\d\\-\\_]{4,30}$')
| summarize by ClientIP, UserAgent
@davecober
Copy link

Could this also be used to query in the M365 Security Center Advanced Hunting?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment