New time zone observed

Description

'This hunting query identifies users joining a meeting from a time zone that a user has not been observed from in the last 30 days.'

Query · kql

let previous_tz = (
  ZoomLogs
  | where Event =~ "meeting.participant_joined"
  | extend TimeZone = columnifexists('payload_object_timezone_s', "")
  | summarize by TimeZone
);
ZoomLogs
| where Event =~ "meeting.participant_joined"
| extend TimeZone = columnifexists('payload_object_timezone_s', "")
| where isnotempty(TimeZone) and TimeZone in (previous_tz)
| extend timestamp = TimeGenerated, AccountCustomEntity = User
Raw source New time zone observed · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 5ca3868b-9245-4573-894c-55a935736018
name: New time zone observed
description: |
  'This hunting query identifies users joining a meeting from a time zone that a user has not been observed from in the last 30 days.'
requiredDataConnectors: []
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |

  let previous_tz = (
    ZoomLogs
    | where Event =~ "meeting.participant_joined"
    | extend TimeZone = columnifexists('payload_object_timezone_s', "")
    | summarize by TimeZone
  );
  ZoomLogs
  | where Event =~ "meeting.participant_joined"
  | extend TimeZone = columnifexists('payload_object_timezone_s', "")
  | where isnotempty(TimeZone) and TimeZone in (previous_tz)
  | extend timestamp = TimeGenerated, AccountCustomEntity = User
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Community
    categories:
        domains: [ "Security - Other" ]

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.