Dormant User Update MFA and Logs In - UEBA

id: 6adc74fb-37f9-4187-ba7c-84269b09a485
name: Dormant User Update MFA and Logs In - UEBA
description: |
  'This query look for accounts that have not been successfully logged into recently who then add or update an MFA method before logging in.
  Threat actors may look to re-activate dormant accounts and use them for access by adding MFA methods in the hope that changes to such dormant accounts may go un-noticed. This query uses the Microsoft Sentinel UEBA features.
  Ref: [LINK TO BLOG]'
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
      - AuditLogs
tactics:
  - Persistence
relevantTechniques:
  - T1098
query: |
  let starttime = todatetime('{{StartTimeISO}}');
  let endtime = todatetime('{{EndTimeISO}}');
  let lookback = endtime - 14d;
  let active_users = (
    BehaviorAnalytics
    | extend dormant = tostring(UsersInsights.IsDormantAccount)
    | where isempty(dormant)
    | summarize by UserPrincipalName);
  AuditLogs
  | where TimeGenerated between(starttime..endtime)
  // Get users where they added MFA
  | where OperationName =~ "User registered security info"
  | extend TargetUser = tolower(tostring(TargetResources[0].userPrincipalName))
  | extend UserId = tostring(TargetResources[0].id)
  // Check and see if this activity was from a user who is considered not active
  | where UserId !in (active_users)
  // Further reduce FP by just looking at users who have successfully logged in recently as well (avoiding hits for users adding MFA but not actually logging in)
  | join kind=inner (SigninLogs | where TimeGenerated > ago(1d) | where ResultType == 0 | summarize max(TimeGenerated), make_set(IPAddress), make_set(UserAgent), make_set(LocationDetails) by UserPrincipalName, UserId
  ) on UserId
  | extend LogonLocation = set_LocationDetails[0], LogonUserAgent = set_UserAgent[0], LogonIP = set_IPAddress[0]
  | project-rename MostRecentLogon = max_TimeGenerated
  | project-reorder TimeGenerated, TargetUser, OperationName, ResultDescription, MostRecentLogon, LogonUserAgent, LogonLocation, LogonIP
  | extend AccountCustomEntity = TargetUser, IPCustomEntity = LogonIP
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity