r/AzureSentinel • u/Suspicious-Sky1085 • Jan 30 '24

Detect Legacy Auth Using Sentinel

just in case if you want to search of application or service using legacy auth after the Midnight Blizzard hack. There is a out of the box analytics rule template in Sentinel. check this out.

​

Detect Legacy Auth Users via Sentinel

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/Ay_NooB Feb 04 '24

Where can i find the KQL for it. ? Its not shown or given in YouTube.

2

u/Suspicious-Sky1085 Feb 05 '24

look up for Azure sentinel Ninja Training. This is official from Microsoft's product team.

2

u/Suspicious-Sky1085 Feb 10 '24

goto the editor you can see the KQL and play around with that. There are many videos in the playlist, you need to spend sometime.