← Back to SOC feed Coverage →

Query data volume anomolies

kql MEDIUM Azure-Sentinel
T1030
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-04-24T09:00:00Z · Confidence: medium

Hunt Hypothesis

Users executing large log analytics (LA) queries may indicate data exfiltration or reconnaissance efforts, as adversaries often gather extensive data to plan further attacks. SOC teams should proactively hunt for such anomalies in Azure Sentinel to identify potential data theft or lateral movement attempts early.

KQL Query


let starttime = todatetime('{{StartTimeISO}}');
let endtime = todatetime('{{EndTimeISO}}');
let delta = totimespan((endtime-starttime)*7);
let lookback = starttime - delta;
let threshold = 0;
LAQueryLogs
| where TimeGenerated between(starttime..endtime)
| make-series rows = sum(ResponseRowCount) on TimeGenerated in range(lookback, endtime, 1h)
| extend (anomalies, score, baseline) = series_decompose_anomalies(rows,3, -1, 'linefit')
| mv-expand anomalies to typeof(int), score to typeof(double), TimeGenerated to typeof(datetime)
| where anomalies > threshold
| sort by score desc
| join kind=rightsemi (
LAQueryLogs
| where TimeGenerated between(starttime..endtime)
| summarize make_set(QueryText) by AADEmail, RequestTarget, TimeGenerated = bin(TimeGenerated, 1h))
on TimeGenerated
| project TimeGenerated, AADEmail, RequestTarget, set_QueryText
| extend timestamp = TimeGenerated, AccountCustomEntity = AADEmail

Analytic Rule Definition

id: 97543188-a4e8-4439-980d-17b231149617
name: Query data volume anomolies
description: |
  'This hunting query looks for anomalously large LA queries by users.'
requiredDataConnectors:
  - connectorId: AzureMonitor(Query Audit)
    dataTypes:
      - LAQueryLogs
tactics:
  - Exfiltration
relevantTechniques:
  - T1030
query: |

  let starttime = todatetime('{{StartTimeISO}}');
  let endtime = todatetime('{{EndTimeISO}}');
  let delta = totimespan((endtime-starttime)*7);
  let lookback = starttime - delta;
  let threshold = 0;
  LAQueryLogs
  | where TimeGenerated between(starttime..endtime)
  | make-series rows = sum(ResponseRowCount) on TimeGenerated in range(lookback, endtime, 1h)
  | extend (anomalies, score, baseline) = series_decompose_anomalies(rows,3, -1, 'linefit')
  | mv-expand anomalies to typeof(int), score to typeof(double), TimeGenerated to typeof(datetime)
  | where anomalies > threshold
  | sort by score desc
  | join kind=rightsemi (
  LAQueryLogs
  | where TimeGenerated between(starttime..endtime)
  | summarize make_set(QueryText) by AADEmail, RequestTarget, TimeGenerated = bin(TimeGenerated, 1h))
  on TimeGenerated
  | project TimeGenerated, AADEmail, RequestTarget, set_QueryText
  | extend timestamp = TimeGenerated, AccountCustomEntity = AADEmail
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Pete Bryan
    support:
        tier: Microsoft
    categories:
        domains: [ "Security - Threat Protection" ]

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/LAQueryLogs/QueryDataVolumeAnomolies.yaml