KQL Search

Query Details

Identity Logon Events Unusual Delegated Resource Access

Query

let query_frequency = 1h;
let query_period = 14d;
IdentityLogonEvents
| where TimeGenerated > ago(query_period)
| where LogonType == "Delegated resource access"
| extend
    KerberosDelegationType = tostring(AdditionalFields["KerberosDelegationType"]),
    ActorObjectSid = AccountSid,
    ActorObjectName = tostring(AdditionalFields["ACTOR.DEVICE"]),
    TargetServicePrincipalNames = tostring(AdditionalFields["Spns"])
| summarize TimeGenerated = arg_min(TimeGenerated, *) by KerberosDelegationType, ActorObjectSid, ActorObjectName, IPAddress, TargetServicePrincipalNames, TargetDeviceName, TargetAccountDisplayName
| where TimeGenerated > ago(query_frequency)
| project
    TimeGenerated,
    Application,
    ActionType,
    LogonType,
    Protocol,
    DeviceName,
    KerberosDelegationType,
    ActorObjectSid,
    ActorObjectName,
    IPAddress,
    TargetServicePrincipalNames,
    TargetDeviceName,
    TargetAccountDisplayName,
    AdditionalFields

Explanation

This query is designed to analyze logon events related to delegated resource access over a specified period and frequency. Here's a simple breakdown:

  1. Time Frame: It looks at logon events from the past 14 days (query_period) and focuses on those that occurred in the last hour (query_frequency).

  2. Data Source: The data is pulled from IdentityLogonEvents.

  3. Filtering: It filters events to only include those where the LogonType is "Delegated resource access".

  4. Data Extraction: It extracts additional details from the log events, such as:

    • KerberosDelegationType from the AdditionalFields.
    • ActorObjectSid from AccountSid.
    • ActorObjectName and TargetServicePrincipalNames from AdditionalFields.

  5. Summarization: The query summarizes the data to find the earliest (arg_min) event for each combination of key attributes like KerberosDelegationType, ActorObjectSid, ActorObjectName, etc.

  6. Recent Events: It further filters to include only those summarized events that occurred in the last hour.

  7. Projection: Finally, it selects specific columns to display in the results, including details about the event time, application, action type, logon type, protocol, device names, and additional fields.

In essence, this query helps identify and analyze recent delegated access logon events, focusing on specific attributes and summarizing them for easier review.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: August 12, 2024

Tables

IdentityLogonEvents

Keywords

IdentityLogonEventsTimeGeneratedLogonTypeKerberosDelegationTypeActorObjectSidActorObjectNameIPAddressTargetServicePrincipalNamesTargetDeviceNameTargetAccountDisplayNameApplicationActionTypeProtocolDeviceNameAdditionalFields

Operators

letagowhereextendtostringsummarizearg_minbyproject

Actions

GitHub