KQL Search

Query Details

Anomalous Windows Hello For Business Sign In Without Device ID

Query

let Lookback		= 1d;
let BaselineWindow	= 30d;
let MinBaselineEvents	= 10;			// ignore users with too little history
// Genuine primary WHfB authentications only
let WHfBSignins =
	SigninLogs
	| where TimeGenerated > ago(BaselineWindow)
	| where ResultType == 0
	| where AuthenticationDetails has "Hello"
	| where IncomingTokenType in ("none", "")	// exclude SSO follow-ups and token refreshes
	| mv-apply Detail = todynamic(AuthenticationDetails) on (
			where tobool(Detail.succeeded) == true
				and tostring(Detail.authenticationMethod) == "Windows Hello for Business"
				and tostring(Detail.authenticationStepResultDetail) !has "claim"	// drop inherited MFA claims
			| summarize StepDetail = make_set(tostring(Detail.authenticationStepResultDetail))
		)
	| extend	DeviceId	= tostring(DeviceDetail.deviceId),
			ASN		= tostring(AutonomousSystemNumber);
// Per-user baseline: how consistently does this user present a device ID?
let Baseline =
	WHfBSignins
	| where TimeGenerated between (ago(BaselineWindow) .. ago(Lookback))
	| summarize	BaselineEvents	= count(),
			DeviceIdRatio	= countif(isnotempty(DeviceId)) * 1.0 / count(),
			KnownASNs	= make_set(ASN, 200),
			KnownAgents	= make_set(UserAgent, 200)
			by UserPrincipalName;
WHfBSignins
| where TimeGenerated > ago(Lookback)
| where isempty(DeviceId)
| lookup kind=inner Baseline on UserPrincipalName
| where BaselineEvents >= MinBaselineEvents
| where DeviceIdRatio >= 0.95				// user virtually always submits a device ID
| extend	NewASN		= isnotempty(ASN) and not(set_has_element(KnownASNs, ASN)),
		NewUserAgent	= isnotempty(UserAgent) and not(set_has_element(KnownAgents, UserAgent)),
		RiskySignin	= RiskLevelDuringSignIn in ("medium", "high")
| extend Score =	toint(iff(NewASN, 40, 0))
			+ toint(iff(NewUserAgent, 30, 0))
			+ toint(iff(RiskySignin, 30, 0))
			+ toint(iff(ConditionalAccessStatus == "notApplied", 10, 0))
| where Score >= 40					// require at least one strong novelty signal
| extend Verdict = case(
		Score >= 70,	"High: WHfB primary auth without device ID from a previously unseen network or client",
		"Medium: WHfB primary auth without device ID, single novelty signal")
| project	Verdict,
		Score,
		TimeGenerated,
		UserPrincipalName,
		IPAddress,
		ASN,
		Location,
		UserAgent,
		AppDisplayName,
		ResourceDisplayName,
		ConditionalAccessStatus,
		RiskLevelDuringSignIn,
		DeviceIdRatio,
		NewASN,
		NewUserAgent,
		CorrelationId
| order by Score desc, TimeGenerated desc

About this query

Explanation

This KQL query is designed to identify unusual sign-in activities using Windows Hello for Business (WHfB) where a device ID is not provided, even though the user typically provides one. Here's a simplified breakdown of what the query does:

  1. Time Frame and Data Collection:

    • It looks at sign-in logs over the past 30 days to establish a baseline of normal user behavior.
    • It specifically focuses on successful primary authentications using Windows Hello for Business.

  2. Baseline Creation:

    • For each user, it calculates how often they provide a device ID during sign-ins.
    • It also records known network locations (ASNs) and user agents (browsers or apps used to sign in).

  3. Anomaly Detection:

    • The query then examines sign-ins from the last day where no device ID is provided.
    • It checks if these sign-ins come from new network locations, use new user agents, or have a medium to high risk level.

  4. Scoring and Verdict:

    • Each sign-in is scored based on the presence of new network locations, user agents, risk levels, and whether conditional access policies were applied.
    • A score of 40 or more indicates a potential anomaly, with higher scores indicating more suspicious activity.
    • The query assigns a "High" or "Medium" verdict based on the score and novelty signals.

  5. Output:

    • It lists the suspicious sign-ins, showing details like the user's name, IP address, network location, user agent, application used, and risk level.

Overall, this query helps security teams identify potentially compromised accounts by flagging sign-ins that deviate from a user's normal behavior, particularly when a device ID is unexpectedly missing.