RDP to hybrid joined device followed by Entra access

This query hunts for successful RDP logons by hybrid identities to hybrid or Entra-joined devices that are followed by near-term successful Entra sign-in activity.

Detection logic

Detection requirements

Platform: IaaS Identity Provider Office Suite SaaS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: azureactivedirectory microsoftthreatprotection
Log source service: aadnoninteractiveusersigninlogs deviceinfo devicelogonevents identityinfo

Detection rules

RDP to hybrid joined device followed by Entra access

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules