Anomalous Microsoft Entra ID apps based on authentication location

Description

'This query over Microsoft Entra ID sign-in activity highlights Microsoft Entra ID apps with an unusually high ratio of distinct geolocations versus total number of authentications'

Query · kql

let azureSignIns = 
SigninLogs
| where SourceSystem == "Azure AD"
| where OperationName == "Sign-in activity"
| project TimeGenerated, OperationName, AppDisplayName , Identity, UserId, UserPrincipalName, Location, LocationDetails, 
ClientAppUsed, DeviceDetail, ConditionalAccessPolicies;
azureSignIns
| extend locationString = strcat(tostring(LocationDetails["countryOrRegion"]), "/", 
tostring(LocationDetails["state"]), "/", tostring(LocationDetails["city"]), ";" , tostring(LocationDetails["geoCoordinates"]))
| summarize rawSigninCount = count(), countByAccount = dcount(UserId), locationCount = dcount(locationString) by AppDisplayName
// tail - pick a threshold to rule out the very-high volume Azure AD apps
| where rawSigninCount < 1000
// more locations than accounts
| where locationCount>countByAccount
// almost as many / more locations than sign-ins!
| where 1.0*rawSigninCount / locationCount > 0.8 
| order by rawSigninCount  desc
| join kind = leftouter (
   azureSignIns 
) on AppDisplayName 
| project AppDisplayName, TimeGenerated , Identity, rawSigninCount, countByAccount, locationCount,  
locationString = strcat(tostring(LocationDetails["countryOrRegion"]), "/", tostring(LocationDetails["state"]), "/", 
tostring(LocationDetails["city"]), ";" , tostring(LocationDetails["geoCoordinates"])), UserPrincipalName
| extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName 
| order by AppDisplayName, TimeGenerated desc
Raw source Anomalous Microsoft Entra ID apps based on authentication location · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 73ac88c0-f073-4b23-8ac4-9f40ea11308d
name: Anomalous Microsoft Entra ID apps based on authentication location
description: |
  'This query over Microsoft Entra ID sign-in activity highlights Microsoft Entra ID apps with 
  an unusually high ratio of distinct geolocations versus total number of authentications'
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |

  let azureSignIns = 
  SigninLogs
  | where SourceSystem == "Azure AD"
  | where OperationName == "Sign-in activity"
  | project TimeGenerated, OperationName, AppDisplayName , Identity, UserId, UserPrincipalName, Location, LocationDetails, 
  ClientAppUsed, DeviceDetail, ConditionalAccessPolicies;
  azureSignIns
  | extend locationString = strcat(tostring(LocationDetails["countryOrRegion"]), "/", 
  tostring(LocationDetails["state"]), "/", tostring(LocationDetails["city"]), ";" , tostring(LocationDetails["geoCoordinates"]))
  | summarize rawSigninCount = count(), countByAccount = dcount(UserId), locationCount = dcount(locationString) by AppDisplayName
  // tail - pick a threshold to rule out the very-high volume Azure AD apps
  | where rawSigninCount < 1000
  // more locations than accounts
  | where locationCount>countByAccount
  // almost as many / more locations than sign-ins!
  | where 1.0*rawSigninCount / locationCount > 0.8 
  | order by rawSigninCount  desc
  | join kind = leftouter (
     azureSignIns 
  ) on AppDisplayName 
  | project AppDisplayName, TimeGenerated , Identity, rawSigninCount, countByAccount, locationCount,  
  locationString = strcat(tostring(LocationDetails["countryOrRegion"]), "/", tostring(LocationDetails["state"]), "/", 
  tostring(LocationDetails["city"]), ";" , tostring(LocationDetails["geoCoordinates"])), UserPrincipalName
  | extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName 
  | order by AppDisplayName, TimeGenerated desc
  
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Shain
    support:
        tier: Community
    categories:
        domains: [ "Security - Other", "Identity" ]

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.