KQL
Identify failed login attempts against disabled accounts that took place between March 3rd 2023 and March 6th 2023
event.code:4625
AND winlog.event_data.SubStatus:0xC0000072
AND @timestamp >= "2023-03-03T00:00:00.000Z"
AND @timestamp <= "2023-03-06T23:59:59.999Z"
Show events that have the Windows event code 4625 (failed login attempts) and where the username starts with "admin"
event.code:4625 AND user.name: admin*
NOT user.name: *$ AND winlog.channel.keyword: Security
Identify users who have successfully deleted more than 10 Azure resources in the past 7 days
let resource_threshold = 10;
let time_threshold = 7d;
AzureActivity
| where TimeGenerated > ago(time_threshold)
| where OperationNameValue endswith "DELETE" and ActivityStatusValue == "Success"
| summarize number_of_records = count() by Caller, ActivityStatusValue
| where number_of_records > resource_threshold
Analyze Azure network traffic to identify malicious flows targeting a specific VM
let my_vm_ip_addr = "10.0.0.5";
AzureNetworkAnalytics_CL
| where FlowType_s == "MaliciousFlow" and TimeGenerated > ago(5h) and DestIP_s in (my_vm_ip_addr)
| summarize flow_count = count() by SrcIP_s, DestIP_s, FlowType_s
| order by flow_count
Analyze Azure failed logon events
DeviceLogonEvents
| where TimeGenerated >= ago(5h)
| where ActionType == "LogonFailed"
| summarize NumberOfFailures = count() by RemoteIP, ActionType, DeviceName
| where NumberOfFailures >= 50