KQL Search

Query Details

Password Reset On High Privileged User

Query

let HighPrivRoles = dynamic(["Global Administrator", "Company Administrator", "Privileged Authentication Administrator", "Privileged Role Administrator"]);
AuditLogs
| where OperationName == "Reset user password"
| mv-expand TargetResources
| extend TargetUsername = tostring(TargetResources.userPrincipalName)
| join kind=innerunique (
    IdentityInfo 
    | where TimeGenerated > ago(14d)
    )
    on $left.TargetUsername == $right.AccountUPN
| mv-expand AssignedRoles
| extend AssignedRoles = tostring(AssignedRoles)
| where AssignedRoles in (HighPrivRoles)
| summarize by TimeGenerated, TargetUsername, AssignedRoles, OperationName, AADUserId=AccountObjectId

Explanation

This query is used to identify instances where the password of a user in a high privileged role has been reset. It checks the audit logs for the operation "Reset user password" and joins it with the IdentityInfo table to get additional information about the user. It then filters the results to only include users in high privileged roles and summarizes the data by various attributes. If an incident is created, it will not be grouped with other incidents and will have a lookback duration of 5 hours. The query runs every 3 hours and has a severity level of Medium.