Recon Activity with Interactive Logon Correlation

Hunt Hypothesis

Adversaries may use interactive logon sessions to establish persistent access after initial reconnaissance, leveraging T1190 and T1078 to move laterally and maintain control. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential post-compromise activity and prevent further lateral movement.

KQL Query

SecurityAlert
| where AlertName has_any ('Atypical travel','Unfamiliar sign-in properties','Anonymous IP address','Malware linked IP address','Malicious IP address','Password Spray','Targeted port scans')
| summarize count(),make_set(AlertName) by WorkspaceSubscriptionId,CompromisedEntity= toupper(CompromisedEntity),TimeGenerated
| extend number_alerts = array_length(set_AlertName)
| join kind=inner
(
SecurityEvent
| where EventID == 4624 and LogonType == 10
  | project  Account = tolower(Account), Computer = toupper(Computer), IpAddress, AccountType, Activity, LogonTypeName,Interactivelogontime=TimeGenerated
  ) on  $left.CompromisedEntity==$right.Computer
  | project TimeGenerated,Interactivelogontime,AccountCustomEntity=Account,AccountType,CompromisedEntity,Activity,IpAddress
  | extend TimeWindow = TimeGenerated + 15m
  | where Interactivelogontime between (TimeGenerated .. TimeWindow)

Analytic Rule Definition

id: 346d36c9-2e79-4d8f-8c14-1eef73d38737
name: Recon Activity with Interactive Logon Correlation
description: |
  'This query looks at correlating different reconnaissance alerts with interactive logon logs to help analysts investigate initial possible compromise activity'
requiredDataConnectors:
  - connectorId: AzureSecurityCenter
    dataTypes:
      - SecurityAlert (ASC)
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes: 
      - SecurityEvents 
  - connectorId: WindowsForwardedEvents
    dataTypes: 
      - WindowsEvent 
tactics:
  - InitialAccess
  - Impact
relevantTechniques:
  - T1190
  - T1078
query: |
    SecurityAlert
    | where AlertName has_any ('Atypical travel','Unfamiliar sign-in properties','Anonymous IP address','Malware linked IP address','Malicious IP address','Password Spray','Targeted port scans')
    | summarize count(),make_set(AlertName) by WorkspaceSubscriptionId,CompromisedEntity= toupper(CompromisedEntity),TimeGenerated
    | extend number_alerts = array_length(set_AlertName)
    | join kind=inner
    (
    SecurityEvent
    | where EventID == 4624 and LogonType == 10
      | project  Account = tolower(Account), Computer = toupper(Computer), IpAddress, AccountType, Activity, LogonTypeName,Interactivelogontime=TimeGenerated
      ) on  $left.CompromisedEntity==$right.Computer
      | project TimeGenerated,Interactivelogontime,AccountCustomEntity=Account,AccountType,CompromisedEntity,Activity,IpAddress
      | extend TimeWindow = TimeGenerated + 15m
      | where Interactivelogontime between (TimeGenerated .. TimeWindow)
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IpAddress

    

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Tactic: Impact
• Technique: T1190 — T1190
• Technique: T1078 — T1078

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/MultipleDataSources/ReconActivitywithInteractiveLogonCorrelation.yaml)

False Positive Guidance

• Scenario: System Maintenance Task via Task Scheduler
  Description: A legitimate system maintenance task, such as updating software or cleaning temporary files, is scheduled via Task Scheduler and triggers interactive logon.
  Filter/Exclusion: ProcessName != "schtasks.exe" OR ProcessCommandLine NOT LIKE '%/s%'

• Scenario: Remote Desktop Services (RDS) Logon
  Description: A user logs in via Remote Desktop Protocol (RDP) as part of normal remote access operations.
  Filter/Exclusion: LogonType = "Interactive" AND LogonType != "RemoteInteractive"

• Scenario: Admin Tool Execution with Interactive Logon
  Description: An administrator uses tools like PsExec or PSTools to run commands interactively on a remote machine.
  Filter/Exclusion: ProcessName != "psexec.exe" OR ProcessCommandLine NOT LIKE '%-s%'

• Scenario: Scheduled Job with Interactive Logon
  Description: A scheduled job, such as a backup or report generation, is configured to run interactively, which is common in some enterprise environments.
  Filter/Exclusion: ProcessName != "schtasks.exe" OR ProcessCommandLine NOT LIKE '%/s%'

• Scenario: User-Initiated Logon for Support
  Description: A support technician logs in interactively to assist a user with a problem, which may trigger the rule.
  Filter/Exclusion: LogonType = "Interactive" AND UserRole != "Support" OR UserRole != "Helpdesk"