Sunturai
Back to results
LowMicrosoft Sentinel analyticsMicrosoft Security Research

Multiple Password Reset by user

This query will determine multiple password resets by user across multiple data sources. Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission…

Description

This query will determine multiple password resets by user across multiple data sources. Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
azureactivedirectoryoffice365securityeventssyslogwindowsforwardedeventswindowssecurityevents
Log source service
auditlogsofficeactivitysecurityeventsecurityeventssyslogwindowsevent

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice