Rules Contributing to Microsoft Entra Unusual Account Creation Alert

The following rules are used to identify Microsoft Entra unusual account creation activity. Any one or more of these will trigger the Microsoft Entra Unusual Account Creation Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Account Created and Deleted within a Close Timeframe

Detects when an account was created and deleted in a short period of time.

Rule ID

azure_44

Query

{'selection': {'Result': 'sccess', 'properties_message': ['Add user', 'Delete user']}, 'condition': 'selection'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,6f583da0-3a90-4566-a4ed-83c09fe18bbf

Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton

Tactics, Techniques, and Procedures

DEFENSE_EVASION, T1078

References

Severity

75

Suppression Logic Based On

  • azure_ad.initiatedBy.user.id
  • azure_ad.initiatedBy.app.servicePrincipalId
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
experimental 2022/08/11 high

  • Legit administrative action