HUNT 21 Caller IP Concentration
Query
// Hunt : Hunt - Caller IP Concentration Across Many Identities (7d)
// Tactics : LateralMovement, CredentialAccess
// MITRE : T1550
// Purpose : Surfaces a single source IP driving management-plane operations for 5+ distinct
// identities in 7 days. Beyond shared corporate egress (allowlist those), this is a
// classic token-theft / credential-replay signature where one attacker host wields
// many stolen identities. Add trusted egress IPs to the NetworkAllowlist watchlist.
//==========================================================================================
let Window = 7d;
let IdentityThreshold = 5;
AzureActivity
| where TimeGenerated > ago(Window)
| where isnotempty(CallerIpAddress) and isnotempty(Caller)
| where CallerIpAddress !startswith "168.63." and CallerIpAddress !startswith "169.254."
| summarize
Identities = dcount(Caller),
Callers = make_set(Caller, 25),
Ops = count(),
Operations = make_set(OperationNameValue, 10)
by CallerIpAddress
| where Identities >= IdentityThreshold
| order by Identities desc, Ops descExplanation
This query is designed to identify suspicious activity in Azure by detecting a single source IP address that is performing management operations on behalf of multiple distinct user identities within a 7-day period. Here's a simple breakdown of what the query does:
-
Time Frame: It looks at data from the past 7 days.
-
Source IP Filtering: It excludes certain IP ranges (those starting with "168.63." and "169.254.") which are typically internal or reserved IP addresses.
-
Data Aggregation: For each unique source IP address, it counts the number of distinct user identities (Callers) associated with that IP, collects a list of these identities, counts the total number of operations performed, and collects a list of distinct operation names.
-
Suspicious Activity Detection: It filters the results to only include IP addresses associated with 5 or more distinct identities, which could indicate potential token theft or credential replay attacks.
-
Sorting: The results are sorted to show IP addresses with the highest number of distinct identities and operations first.
The purpose of this query is to help identify potential security threats where a single IP address is being used to perform actions on behalf of multiple users, which is often a sign of compromised credentials. Trusted IP addresses can be added to a watchlist to avoid false positives.
