High-Risk User with New Device Code Authentication

let target_user = "<candidate_user>";
AADUserRiskEvents
| where TimeGenerated >= ago(7d)
| where UserPrincipalName =~ target_user
| where RiskLevel in~ ("medium", "high")
| where RiskState in~ ("atRisk", "confirmedCompromised")
| project
    TimeGenerated,
    ActivityDateTime,
    DetectedDateTime,
    UserPrincipalName,
    UserId,
    IpAddress,
    RiskEventType,
    RiskLevel,
    RiskState,
    RiskDetail,
    DetectionTimingType,
    Activity,
    CorrelationId,
    RequestId
| order by TimeGenerated asc

index=<entra_risk_index> sourcetype=<entra_user_risk_sourcetype>
earliest=-7d
| eval
    user=lower(coalesce(user, UserPrincipalName, user_principal_name)),
    src=coalesce(src, IpAddress, ip_address),
    risk_type=coalesce(risk_type, RiskEventType),
    risk_level=lower(coalesce(risk_level, RiskLevel)),
    risk_state=lower(coalesce(risk_state, RiskState)),
    correlation_id=coalesce(correlation_id, CorrelationId),
    request_id=coalesce(request_id, RequestId)
| where user="<candidate_user>"
    AND risk_level IN ("medium","high")
    AND risk_state IN ("atrisk","confirmedcompromised")
| table _time user src risk_type risk_level risk_state correlation_id request_id
| sort 0 _time

let target_user = "<candidate_user>";
EntraIdSigninEvents
| where Timestamp >= ago(7d)
| where AccountUpn =~ target_user
| where ErrorCode in (0, 50199)
| summarize
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    ErrorCodes=make_set(ErrorCode),
    IPAddresses=make_set(IPAddress, 20),
    RiskLevels=make_set(RiskLevelDuringSignin, 10),
    Applications=make_set(Application, 20)
    by AccountUpn, CorrelationId, SessionId
| where ErrorCodes has_all (0, 50199)
| extend Duration=LastSeen-FirstSeen
| where Duration <= 5m
| order by FirstSeen asc

index=<entra_signin_index> sourcetype=<defender_entra_signin_sourcetype>
earliest=-7d
| eval
    user=lower(coalesce(user, AccountUpn)),
    error_code=coalesce(error_code, ErrorCode),
    correlation_id=coalesce(correlation_id, CorrelationId),
    session_id=coalesce(session_id, SessionId),
    src=coalesce(src, IPAddress)
| where user="<candidate_user>" AND error_code IN (0,50199)
| stats
    min(_time) as first_seen
    max(_time) as last_seen
    values(error_code) as error_codes
    values(src) as source_ips
    values(RiskLevelDuringSignin) as risk_levels
    by user correlation_id session_id
| eval duration=last_seen-first_seen
| where mvfind(error_codes,"50199")>=0 AND mvfind(error_codes,"0")>=0 AND duration<=300
| convert ctime(first_seen) ctime(last_seen)
| sort 0 first_seen

let candidate_user = "<candidate_user>";
let clicks =
    UrlClickEvents
    | where Timestamp >= ago(7d)
    | extend AccountUpn=tolower(AccountUpn)
    | where AccountUpn == tolower(candidate_user)
    | project ClickTime=Timestamp, ActionType, UrlChain, NetworkMessageId, Url, AccountUpn;
EntraIdSigninEvents
| where Timestamp >= ago(7d)
| where ErrorCode == 0
| where RiskLevelDuringSignin in (10, 50, 100)
| extend AccountUpn=tolower(AccountUpn)
| where AccountUpn == tolower(candidate_user)
| join kind=inner clicks on AccountUpn
| where (Timestamp - ClickTime) between (-2m .. 7m)
| project Timestamp, ClickTime, AccountUpn, RiskLevelDuringSignin, SessionId, CorrelationId, IPAddress, Url, UrlChain, NetworkMessageId, ActionType
| order by Timestamp asc

(
    index=<url_click_index> sourcetype=<defender_url_click_sourcetype> earliest=-7d
)
OR
(
    index=<entra_signin_index> sourcetype=<defender_entra_signin_sourcetype> earliest=-7d
)
| eval
    user=lower(coalesce(user,AccountUpn)),
    event_type=case(
        isnotnull(NetworkMessageId),"url_click",
        isnotnull(ErrorCode),"signin",
        true(),"other"
    ),
    error_code=coalesce(error_code,ErrorCode),
    signin_risk=coalesce(signin_risk,RiskLevelDuringSignin),
    session_id=coalesce(session_id,SessionId),
    correlation_id=coalesce(correlation_id,CorrelationId),
    src=coalesce(src,IPAddress)
| where user="<candidate_user>"
| sort 0 user _time
| streamstats current=f
    last(eval(if(event_type="url_click",_time,null()))) as click_time
    last(eval(if(event_type="url_click",Url,null()))) as clicked_url
    last(eval(if(event_type="url_click",NetworkMessageId,null()))) as message_id
    by user
| where event_type="signin" AND error_code=0 AND signin_risk IN (10,50,100)
    AND isnotnull(click_time) AND (_time-click_time)>=-120 AND (_time-click_time)<=420
| table _time click_time user signin_risk src session_id correlation_id clicked_url message_id
| sort 0 _time

let target_user = "<candidate_user>";
CloudAppEvents
| where Timestamp >= ago(7d)
| where AccountObjectId != ""
| extend UserPrincipalName = tolower(tostring(RawEventData.ObjectId))
| where UserPrincipalName == tolower(target_user)
    or AccountDisplayName =~ target_user
| where AccountDisplayName == "Device Registration Service"
    or ActionType in (
        "New-InboxRule",
        "Set-InboxRule",
        "Enable-InboxRule",
        "UpdateInboxRules",
        "MailItemsAccessed"
    )
| project
    Timestamp,
    AccountDisplayName,
    ActionType,
    ApplicationId,
    IPAddress,
    UncommonForUser,
    ActivityObjects,
    RawEventData
| order by Timestamp asc

index=<cloud_app_index> sourcetype=<cloud_app_events_sourcetype>
earliest=-7d
| eval
    user=lower(coalesce(user, UserPrincipalName, AccountDisplayName)),
    action=coalesce(action, ActionType),
    app_id=coalesce(app_id, ApplicationId),
    src=coalesce(src, IPAddress)
| where user="<candidate_user>"
    AND (
        action IN ("New-InboxRule","Set-InboxRule","Enable-InboxRule","UpdateInboxRules","MailItemsAccessed")
        OR AccountDisplayName="Device Registration Service"
    )
| fields _time user src action app_id AccountDisplayName UncommonForUser ActivityObjects RawEventData
| sort 0 _time