Add hunting queries: Entra ID cross-source correlation hunting pack (3 queries)

[descambiado]

Summary

This PR adds three hunting queries that correlate data across multiple Entra ID log sources to surface post-compromise patterns that are not visible from a single table. All three queries use baseline periods to reduce noise and focus on genuinely anomalous activity rather than broad event collection.

This bundle follows PR #14239 (merged) and PR #14240 (open), continuing the same thematic focus on Entra ID identity threat detection.

Queries included

1. MFARegistrationFromUnseenIP.yaml

Correlates AuditLogs MFA registration events (User registered security info) with a 30-day per-user IP baseline from SigninLogs. Flags any MFA method enrollment from an IP address not previously observed in that user's successful sign-in history. An attacker who obtains credentials may register an attacker-controlled authenticator before the victim notices, establishing persistent MFA-backed access that survives a password reset. This query does not require Entra ID P2 licensing and complements HighRiskSignInAroundAuthMethodOrDeviceRegistration, which requires risk scores.

• Tables: AuditLogs + SigninLogs
• MITRE: T1556.006 - Persistence, DefenseEvasion

2. SignInFromNewCountryWithSensitiveOperation.yaml

Correlates a successful sign-in from a country not observed in the user's 30-day baseline with a sensitive AuditLogs operation performed by the same user within one hour. Sensitive operations monitored include role member additions, application consent grants, service principal credential additions, application registrations, Conditional Access policy changes, domain authentication changes, and PIM activations. The narrow one-hour correlation window and country novelty baseline together produce a high-signal pattern consistent with stolen-credential access followed by immediate privilege abuse.

• Tables: SigninLogs + AuditLogs
• MITRE: T1078.004, T1098 - InitialAccess, Persistence, PrivilegeEscalation

3. BulkRoleAssignmentsInShortWindow.yaml

Flags actors who assign directory roles to three or more users within a ten-minute window, enriched with the actor's most recent sign-in country from SigninLogs. Legitimate role administration is deliberate and individual. A high volume of rapid role assignments is consistent with automated post-compromise persistence where an attacker grants directory roles to multiple controlled accounts before remediation occurs. The threshold is parameterised and can be adjusted per environment.

• Tables: AuditLogs + SigninLogs
• MITRE: T1098.003 - Persistence, PrivilegeEscalation

Relationship to existing queries

• DormantUserUpdateMFAandLogsIn.yaml - existing query targets dormant accounts with no recent sign-in. Query 1 here targets any active user registering MFA from a new IP, which is a different and complementary signal.
• HighRiskSignInAroundAuthMethodOrDeviceRegistration.yaml - requires Entra ID P2 risk scores. Query 1 here uses IP novelty and requires no P2 licensing.
• No existing query in the repository correlates country-novel sign-ins with immediate sensitive operations, or detects bulk role assignment velocity.

Testing

Queries were authored against the AuditLogs and SigninLogs schemas. KQL patterns and YAML structure follow the conventions of the existing MultipleDataSources hunting queries in this repository. All files were validated for non-ASCII characters before commit.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds three new hunting queries for Entra ID cross-source correlation, focusing on post-compromise patterns by correlating AuditLogs and SigninLogs with baseline-based anomaly detection.

Changes:

• Adds query for MFA method registrations from IPs absent in user's 30-day sign-in baseline
• Adds query correlating new-country sign-ins with sensitive admin operations within 1 hour
• Adds query detecting bulk role assignments (≥3 in 10 minutes) by a single actor

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
Hunting Queries/MultipleDataSources/MFARegistrationFromUnseenIP.yaml	New hunt for MFA registration from previously unseen IPs
Hunting Queries/MultipleDataSources/SignInFromNewCountryWithSensitiveOperation.yaml	New hunt correlating geographic novelty with sensitive operations
Hunting Queries/MultipleDataSources/BulkRoleAssignmentsInShortWindow.yaml	New hunt for rapid bulk directory role assignments