Multiple Unexpected AD FS Authentication Flow

Query

let query_frequency = 5m;
let query_period = 2d;
let query_wait = 30m;
let _ExpectedADFSIPAddress = toscalar(
    _GetWatchlist("Activity-ExpectedSignificantActivity")
    | where Activity == "ADFSAuthenticationAddress"
    | summarize make_list(SourceAddress)
);
let _ExpectedProxyIPAddress = toscalar(
    _GetWatchlist("IP-Vendors")
    | where Notes has "[Proxy]"
    | summarize make_list(IPAddress)
);
ADFSSignInLogs
| where TimeGenerated between (ago(query_frequency + query_wait) .. ago(query_wait))
| where ResultType == 0 and isnotempty(IPAddress)
| mv-apply AuthenticationProcessingDetail = todynamic(AuthenticationProcessingDetails) on (
    where AuthenticationProcessingDetail has "IP Addresses Involved in Auth Flow"
    | extend IPAddressesInvolved = split(tostring(AuthenticationProcessingDetail["value"]), ",")
    )
| project-away AuthenticationProcessingDetail
| where not(array_length(IPAddressesInvolved) == 1) and not(IPAddress in (_ExpectedADFSIPAddress))
| summarize Auxiliar = arg_max(array_length(IPAddressesInvolved), IPAddressesInvolved) by UserId, CorrelationId
| project-away Auxiliar
| join kind = inner (
    union SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(query_period + query_wait)
    | where isnotempty(CorrelationId) and isnotempty(SessionId)
    | project UserId, CorrelationId, SessionId
    ) on UserId, CorrelationId
| project-away *1
| join kind = inner (
    union SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(query_period + query_wait)
    | where isnotempty(SessionId)
    ) on UserId, SessionId
| project-away *1
| summarize
    arg_min(CreatedDateTime, *),
    AccesedApps = array_sort_asc(make_set_if(AppDisplayName, ResultType == 0, 50)),
    AccessedResources = array_sort_asc(make_set_if(ResourceDisplayName, ResultType == 0, 50)),
    SessionIds = make_set(SessionId),
    CorrelationIds = make_set(CorrelationId)
    by UserId, IPAddress, HomeTenantId, ResourceTenantId
| where not(ipv4_is_in_any_range(IPAddress, _ExpectedProxyIPAddress))
| project
    TimeGenerated,
    CreatedDateTime,
    UserPrincipalName,
    UserDisplayName,
    SessionIds,
    IPAddressesInvolved,
    IPAddress,
    Location,
    NetworkLocationDetails,
    AutonomousSystemNumber,
    AuthenticationDetails,
    ClientAppUsed,
    DeviceDetail = coalesce(tostring(DeviceDetail_dynamic), DeviceDetail_string),
    UserAgent,
    Category,
    AccesedApps,
    AccessedResources,
    HomeTenantId,
    ResourceTenantId,
    CorrelationIds,
    UserId

Explanation

This query is designed to analyze and identify unusual authentication activities in ADFS (Active Directory Federation Services) sign-in logs. Here's a simplified breakdown of what the query does:

Define Parameters:
- query_frequency: The frequency at which the query runs (5 minutes).
- query_period: The time period over which data is analyzed (2 days).
- query_wait: A waiting period to ensure data completeness (30 minutes).
Retrieve Expected IP Addresses:
- _ExpectedADFSIPAddress: Fetches a list of expected ADFS authentication IP addresses from a watchlist.
- _ExpectedProxyIPAddress: Fetches a list of expected proxy IP addresses from a watchlist.
Filter ADFS Sign-In Logs:
- Looks at ADFS sign-in logs within a specific time window.
- Filters for successful logins (ResultType == 0) with non-empty IP addresses.
- Extracts and processes IP addresses involved in the authentication flow.
- Excludes logs where only one IP address is involved or the IP address is expected.
Correlate with Other Sign-In Logs:
- Joins the filtered ADFS logs with other sign-in logs (SigninLogs and AADNonInteractiveUserSignInLogs) based on UserId and CorrelationId.
- Further joins based on SessionId to gather more related sign-in data.
Summarize and Filter Results:
- Summarizes the data to find the earliest occurrence of each event and compiles lists of accessed applications and resources.
- Filters out any logs where the IP address is within the expected proxy IP addresses.
Project Final Output:
- Selects and organizes relevant fields for the final output, including user details, session information, IP addresses, location details, and accessed resources.

Overall, this query is designed to detect potentially suspicious authentication activities by identifying sign-ins from unexpected IP addresses and correlating them with other sign-in events to provide a comprehensive view of the user's activity.