Cross-service Azure Data Explorer queries

id: 58b17f82-f594-4d36-9b78-4e4b03992708
name: Cross-service Azure Data Explorer queries
description: |
  'Under specific circumstances, executing KQL queries can exfiltrate information like access tokens, regarding external data functions like adx().
  This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
  Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
  Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
requiredDataConnectors:
  - connectorId: AzureMonitor(Query Audit)
    dataTypes:
      - LAQueryLogs
tactics:
  - Exfiltration
relevantTechniques:
  - T1567
query: |
  let StringToSearch = @"\badx\s*\(";
  let ExtractQueriedClusterAddress = @"([^\w]|^)adx\s*\(([^\)]*)\)";
  LAQueryLogs
  | where QueryText matches regex StringToSearch
  | extend QueriedClusterAddress = extract_all(ExtractQueriedClusterAddress, dynamic([2]), QueryText)
  | mv-expand QueriedClusterAddress to typeof(string)
  | where isnotempty(QueriedClusterAddress)
  | project TimeGenerated, AADEmail, QueriedClusterAddress, ResponseCode, QueryText, RequestTarget