KQL query to monitor or hunt for users modifying their own identities

identitybackdoor.kql

// Users changing their own identities hunting
// Query by @_dirkjan / Outsider Security - released as CC BY (https://creativecommons.org/licenses/by/2.0/)
AuditLogs
| where OperationName =~ "Update user"
| where Result =~ "success"
| mv-expand target = TargetResources
| extend targetUPN = tostring(TargetResources[0].userPrincipalName)
| extend targetId = tostring(TargetResources[0].id)
| extend targetType = tostring(TargetResources[0].type)
| extend modifiedProps = TargetResources[0].modifiedProperties
| extend initiatedUser = tostring(InitiatedBy.user.userPrincipalName)
| where targetUPN  == initiatedUser
| mv-expand modifiedProps
| where modifiedProps.displayName =~ "AlternativeSecurityId"
| extend new_value_set = parse_json(tostring(modifiedProps.newValue))
| extend old_value_set = parse_json(tostring(modifiedProps.oldValue))
| where array_length(new_value_set) > 0
| extend identityProvider = new_value_set[0].IdentityProvider
| extend identity = base64_decode_tostring(tostring(new_value_set[0].Key))
| project-away old_value_set, new_value_set, modifiedProps