← Back to SOC feed Coverage →

ImpersonatedUserFootprint

kql MEDIUM Azure-Sentinel
AlertEvidenceDeviceLogonEvents
credential-thefthuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-23T11:00:00Z · Confidence: medium

Hunt Hypothesis

Attackers may be using stolen credentials to impersonate a user and perform lateral movement within the network, leveraging Kerberos tickets to execute an overpass-the-hash attack. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate potential privilege escalation and unauthorized access.

KQL Query

AlertInfo
| where ServiceSource =~ "Microsoft Defender for Identity"
| where Title == "Suspected overpass-the-hash attack (Kerberos)"
| extend AlertTime = Timestamp 
| join 
    (
        AlertEvidence 
            | where EntityType == "User"
    ) 
    on AlertId 
| distinct AlertTime,AccountSid 
| join kind=leftouter  
    (
        DeviceLogonEvents
        | where LogonType == "Network" and ActionType == "LogonSuccess"
        | extend LogonTime = Timestamp 
    )
    on AccountSid 
| where LogonTime between (AlertTime .. (AlertTime + 2h))
| project DeviceId , AlertTime , AccountName , AccountSid

Analytic Rule Definition

id: aeb65be9-7a40-409e-a227-56ebbcf33de4
name: ImpersonatedUserFootprint
description: |
  Microsoft Defender for Identity raises alert on suspicious Kerberos ticket, pointing to a potential overpass-the-hash attack.
  Once attackers gain credentials for a user with higher privileges, they will use the stolen credentials to sign into other devices and move laterally.
  This query finds related sign-in events following overpass-the-hash attack to trace the footprint of the impersonated user.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
  - DeviceLogonEvents
tactics:
- Lateral movement
query: |
  AlertInfo
  | where ServiceSource =~ "Microsoft Defender for Identity"
  | where Title == "Suspected overpass-the-hash attack (Kerberos)"
  | extend AlertTime = Timestamp 
  | join 
      (
          AlertEvidence 
              | where EntityType == "User"
      ) 
      on AlertId 
  | distinct AlertTime,AccountSid 
  | join kind=leftouter  
      (
          DeviceLogonEvents
          | where LogonType == "Network" and ActionType == "LogonSuccess"
          | extend LogonTime = Timestamp 
      )
      on AccountSid 
  | where LogonTime between (AlertTime .. (AlertTime + 2h))
  | project DeviceId , AlertTime , AccountName , AccountSid

Required Data Sources

Sentinel TableNotes
AlertEvidenceEnsure this data connector is enabled
DeviceLogonEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Lateral Movement/ImpersonatedUserFootprint.yaml