Switch sign-in and deletion time comparison, and add ResultType sign-in filter for SuspiciousLoginfromDeletedExternalIdentities

[eroll-chorus]

Change(s):

• For rule SuspiciousLoginfromDeletedExternalIdentities (Suspicious Login from deleted guest account):
  • added a filter for successful sign-ins
  • flipped the comparison for the sign-in and deletion times around

Reason for Change(s):

• The rule intends to detect successful sign-ins, but it does not limit results based on sign-in success or failure. As per SigninLogs, a ResultType of 0 indicates a successful sign-in, so checking for this will limit results to sign-in success only
• The rule intends to detect when a successful sign-in occurs after the account was deleted; however, the current logic actually checks that the deletion occurs after the sign-in
  • (See below for examples of the issue vs. proposed solution)

Version Updated:

• Yes

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

Work done in collaboration with @kstew-chorus and @smant-chorus

---

Delete_ and SigninLogs_TimeGenerated Check

Issue with Current Logic

Example Query

let Delete_TimeGenerated = datetime(2023-08-30T14:00:00.000Z);  // Deletion at 14:00 on 30th August 2023
let SigninLogs_TimeGenerated = datetime(2023-08-30T15:00:00.000Z);  // Sign-in at 15:00 on 30th August 2023 (i.e. 1 hour after deletion)
print SignInAfterDeletion = Delete_TimeGenerated > SigninLogs_TimeGenerated

Results

Even though the sign-in occurs after the deletion, the check returns false because Delete_TimeGenerated > SigninLogs_TimeGenerated corresponds to "return true when the deletion occurs after the sign-in". As the purpose of the detection is to identify sign-ins that occur from deleted accounts, the current logic is resulting in a false negative condition for this activity.

Proposed Solution

Example Query

let Delete_TimeGenerated = datetime(2023-08-30T14:00:00.000Z);  // Deletion at 14:00 on 30th August 2023
let SigninLogs_TimeGenerated = datetime(2023-08-30T15:00:00.000Z);  // Sign-in at 15:00 on 30th August 2023 (i.e. 1 hour after deletion)
print SignInAfterDeletion = SigninLogs_TimeGenerated > Delete_TimeGenerated

Results

By switching the check around to SigninLogs_TimeGenerated > Delete_TimeGenerated, it is now correctly checking if the sign-in occurs after the deletion.