Sunturai
Back to results
UnknownMicrosoft Sentinel analytics

Anomalous Password Reset

Adversaries may interrupt the availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to…

Description

Adversaries may interrupt the availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to them. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset User Password where one or more features of the activity deviate from the user, his peers, or the tenant profile.

Detection logic

Detection requirements

Platform
ESXiIaaSLinuxmacOSOffice SuiteSaaSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
azureactivedirectorybehavioranalytics
Log source service
auditlogsbehavioranalytics

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice