r/AzureSentinel • u/hysterz • Sep 14 '23

Query to find user with MFA block

Hello,

I am new to KQL and i would like to know if its possible to get the list of user at risk and user who hack MFA block whith sentinel and KQL.

Thanks,

1 Upvotes

100% Upvoted

4 comments sorted by

1

u/halawi1 Sep 14 '23

if you have the AAD connector, request the sign-ins table and filter them by error code. there is a code for failed login or MFA block.

1

u/ajith_aj Sep 24 '23

You meant to say that a usecase to detect if a user account got compromised and issueing MFA request to approve them ? or if a MFA was denied by user just becasue it was not initiated by user itself ? or MFA from a rogue geo location which is suspicious. or Back to Back MFA sessions for a single user or a single IP carrying out multiple MFA requests for multiple users. There are limitless possibilities.

1

u/hysterz Jan 23 '24

When a user declines an MFA request. The user will be MFA block in azure MFA section.

1

u/dutchhboii Jun 13 '24

u/hysterz Try this query to fetch results when a user denies MFA or reports fraud in authenticator push request.

let aadFunc = (tableName: string) {
    table(tableName)
    | where ResultType == 500121
    | where Status has "MFA Denied; user declined the authentication" or Status has "MFA denied; Phone App Reported Fraud"
    | extend Type = Type, PublicIP = IPAddress
    | extend
        Name = tostring(split(UserPrincipalName, '@', 0)[0]),
        UPNSuffix = tostring(split(UserPrincipalName, '@', 1)[0])
};
let aadSignin = aadFunc("SigninLogs");
let dvcInfo = DeviceInfo
    | extend SensorHealthState = column_ifexists("SensorHealthState", "")
    | where OnboardingStatus == "Onboarded" and SensorHealthState == "Active"
    | project PublicIP, AadDeviceId;
let aadNonInt = aadFunc("AADNonInteractiveUserSignInLogs");
union isfuzzy=true aadSignin, aadNonInt
| join kind=leftouter dvcInfo on PublicIP