Risky sign-in attempt from a non-managed device

id: 8d298b5c-feca-4add-bd42-e43e0a317a88
name: Risky sign-in attempt from a non-managed device
description: |
  In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
description-detailed: |
  In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device as this can be taken into consideration, and a risk score for the sign-in attempt increases the anomalous nature of the activity.
  Reference - https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/hunting-and-responding-to-qr-code-based-phishing-attacks-with/ba-p/4074730 
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EntraIdSignInEvents
  | where Timestamp > ago(7d)
  | where IsManaged != 1
  | where IsCompliant != 1
  //Filtering only for medium and high risk sign-in
  | where RiskLevelDuringSignIn in (50, 100)
  | where ClientAppUsed == "Browser"
  | where isempty(DeviceTrustType)
  | where isnotempty(State) or isnotempty(Country) or isnotempty(City)
  | where isnotempty(IPAddress)
  | where isnotempty(AccountObjectId)
  | where isempty(DeviceName)
  | where isempty(EntraIdDeviceId)
  | project Timestamp,IPAddress, AccountObjectId, ApplicationId, SessionId, RiskLevelDuringSignIn
version: 1.0.0