KQL Search

This query is designed to detect and alert on attempts to reset passwords using Azure Active Directory's Self-Service Password Reset (SSPR) feature that are blocked or throttled. Here's a simple breakdown of what it does:

1. Purpose: It identifies when users' attempts to reset their passwords are blocked by Azure AD SSPR. This could indicate potential malicious activity, such as someone trying to guess security questions or use stolen information.

2. Severity: The alert is classified as "Medium" severity, suggesting a moderate level of concern.

3. Data Source: It uses data from Azure Active Directory's AuditLogs.

4. Frequency: The query runs once a day and looks back over the past day for relevant events.

5. Detection Logic:

   • It filters logs to find events related to "Self-service Password Management" where operations or results are marked as "blocked."
   • It extracts details about the user attempting the reset, the target user, and the IP address from which the attempt was made.
   • It projects these details for further analysis.

6. Tactics and Techniques: The query is associated with tactics like "Initial Access" and "Credential Access," and techniques such as "T1078" (Valid Accounts) and "T1110" (Brute Force).

7. Incident Creation: If any blocked attempts are found, an incident is created. The system groups related events into a single alert to avoid alert fatigue.

8. Version and Configuration: The query is version 1.1.0 and is scheduled to run automatically.

In summary, this query helps in identifying and alerting on potentially malicious attempts to reset passwords using Azure AD's self-service feature, which could be part of a broader attack strategy.