New users running queries

id: 8c4fb385-98b0-4ef5-b3da-65db0fb22d89
name: New users running queries
description: |
  'This hunting query looks for users who have run queries that have not previously been seen running queries.'
requiredDataConnectors:
  - connectorId: AzureMonitor(Query Audit)
    dataTypes:
      - LAQueryLogs
tactics:
  - Collection
relevantTechniques:
  - T1530
  - T1213
query: |

  let starttime = todatetime('{{StartTimeISO}}');
  let endtime = todatetime('{{EndTimeISO}}');
  let lookback = totimespan((endtime-starttime)*7);
  LAQueryLogs
  | where TimeGenerated between(startofday(ago(lookback))..starttime)
  | summarize by AADEmail
  | join kind = rightanti (LAQueryLogs
  | where TimeGenerated between(starttime..endtime))
  on AADEmail
  | project TimeGenerated, AADEmail, QueryText, RequestClientApp, RequestTarget
  | extend timestamp = TimeGenerated, AccountCustomEntity = AADEmail
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Microsoft
    categories:
        domains: [ "Security - Threat Protection" ]