Defender XDR + Sentinel: Advanced Threat Scenarios

📡 Sentinel: DNS Tunnelling Exfiltration Detection

// Sentinel Analytics Rule: DNS Tunnelling Detection
// Severity: High | Run: every 15 min | Look back: 1 hour
let knownDomains = externaldata(Domain:string) 
    [@"https://raw.githubusercontent.com/contoso/secops/main/allowlist.csv"]
    with (format="csv");
DnsEvents
| where TimeGenerated > ago(1h)
| where QueryType in ("TXT", "CNAME", "MX") // Tunnelling favours TXT
| extend SubdomainLength = strlen(tostring(split(Name, ".")[0]))
| extend DomainPart = strcat(tostring(split(Name, ".")[-2]),".",
                             tostring(split(Name, ".")[-1]))
| where DomainPart !in (knownDomains) // Exclude corporate domains
| where SubdomainLength > 30 // High-entropy subdomain = data encoding
| summarize QueryCount = count(),
            AvgSubdomainLen = avg(SubdomainLength),
            UniqueSubdomains = dcount(Name),
            SampleQueries = make_set(Name, 5) by ClientIP, DomainPart
| where QueryCount > 50 and UniqueSubdomains > 30
| extend TunnellingScore = QueryCount * AvgSubdomainLen / 100
| where TunnellingScore > 50
| project TimeGenerated=now(), ClientIP, DomainPart, QueryCount, 
          UniqueSubdomains, TunnellingScore, SampleQueries

Entity mapping: IP → ClientIP | MITRE: T1048.003 Exfiltration Over Alternative Protocol (DNS) | Tactic: Exfiltration

📡 Sentinel: Golden Ticket Anomaly Detection

// Detect TGT anomalies indicating Golden Ticket usage
IdentityLogonEvents
| where Timestamp > ago(1h)
| where LogonType == "Kerberos" and ActionType == "LogonSuccess"
| where Application == "Active Directory"
| extend TicketLifetime = datetime_diff('hour', 
         todatetime(AdditionalFields.TicketExpiry), Timestamp)
| where TicketLifetime > 10 // Default max TGT = 10 hours
| extend EncryptionType = tostring(AdditionalFields.EncryptionType)
| where EncryptionType == "RC4_HMAC" // Golden Tickets often use RC4
| summarize Count=count(), Devices=make_set(DeviceName) 
    by AccountUpn, TicketLifetime, EncryptionType
| project Timestamp=now(), AccountUpn, TicketLifetime, 
          EncryptionType, AnomalyReason="TGT lifetime exceeds policy; RC4 encryption", Devices

Sentinel Playbook: “APT-ContainAndReport”

1. Network isolation: MDE API isolates all 6 compromised devices; allow communication only to MDE cloud service for continued monitoring
2. Block IOCs globally: Push all 14 IOCs (8 domains + 6 IPs) to MDE custom indicators, Sentinel TI feed, and firewall deny lists via API
3. Disable compromised identities: Entra ID API disables 4 compromised accounts, revokes all tokens, removes from all security groups
4. Reset krbtgt: Generate change request ticket for double krbtgt password reset (Golden Ticket invalidation)
5. Trigger forensic collection: MDE investigation packages collected from all 6 devices; disk images initiated for 2 critical servers
6. Notify CISO + Legal: Automated email with Copilot-generated executive briefing; Teams alert to IR commander; government reporting clock started (DFARS 7012 = 72 hours)

Multiple products detect different stages of the supply chain attack:

• MDE: Behavioural anomaly. RMM agent (trusted process) spawns PowerShell that accesses LSASS memory. This never happened before across 8,000 monitored agents.
• MDC: Cloud workload protection detects suspicious outbound traffic from Azure VMs to unusual Azure Storage endpoints not in the organisation’s subscription.
• MDA: Anomalous cloud traffic pattern. RMM process making API calls to unknown cloud storage endpoints.
• Sentinel: Custom KQL rule detects new child processes spawned by the RMM agent process that were never seen in the 90-day behavioural baseline.

📡 Sentinel: Supply Chain Process Anomaly KQL

// Detect new child processes from trusted software agents
// Builds a 90-day baseline and alerts on novel process trees
let trustedAgents = dynamic(["rmmservice.exe", "rmmagent.exe"]);
let baseline = DeviceProcessEvents
| where Timestamp between (ago(90d) .. ago(1d))
| where InitiatingProcessFileName in~ (trustedAgents)
| distinct FileName;
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ (trustedAgents)
| where FileName !in (baseline)  // NEW process never seen before
| where FileName !in~ ("updater.exe","msiexec.exe") // Known update processes
| summarize DeviceCount=dcount(DeviceName), 
            Devices = make_set(DeviceName, 10),
            Commands = make_set(ProcessCommandLine, 5) by FileName
| where DeviceCount >= 3 // Widespread = coordinated deployment
| project TimeGenerated=now(), FileName, DeviceCount, Devices, Commands,
          AlertReason = "New child process from trusted agent across multiple devices"

Sentinel Playbook: “SupplyChain-QuarantineAndRollback”

1. Kill malicious processes: MDE API stops the backdoor process on all 1,800 affected servers (batch operations, 50 servers/minute)
2. Block cloud C2: Add the attacker’s cloud storage URLs to MDE network indicators and firewall ACLs
3. Quarantine binary: MDE quarantines the poisoned RMM agent binary fleet-wide
4. Rotate credentials: Entra ID API rotates all 12 compromised service account passwords and revokes tokens
5. Rollback to safe version: Deploy the last known-good RMM agent via SCCM emergency deployment task sequence
6. Vendor notification: Automated email to vendor CISO with IOCs and supply chain compromise evidence

📡 Sentinel: Cross-Cloud Lateral Movement Detection

// Detect AWS-to-Azure lateral movement via federated trust
let awsSuspiciousIPs = AWSCloudTrail
| where TimeGenerated > ago(1h)
| where EventName in ("AssumeRole","AssumeRoleWithSAML","GetFederationToken")
| where SourceIpAddress !in (knownCorporateIPs)
| distinct SourceIpAddress;
SigninLogs
| where TimeGenerated > ago(1h)
| where IPAddress in (awsSuspiciousIPs)
| where AppDisplayName has "Azure" or ResourceDisplayName has "Azure"
| extend CrossCloudPivot = true
| project TimeGenerated, UserPrincipalName, IPAddress, 
          AppDisplayName, Location, CrossCloudPivot,
          RiskLevel, ConditionalAccessStatus

1. AWS: Rotate compromised IAM key; apply deny-all policy to compromised role; enable GuardDuty findings forwarding to Sentinel
2. Azure: Revoke Azure AD B2C federated token; restrict federation trust to specific IP ranges
3. AKS: Delete cryptominer pods; apply network policy blocking outbound to mining pool IPs; scan all container images
4. Cosmos DB: Rotate all access keys; restrict firewall to application VNet only; enable audit logging
5. GitHub: Trigger GitHub secret scanning alert; rotate all secrets found in repository history

Copilot Prompt: “Generate a KQL query to find unusual usage of certutil, bitsadmin, mshta, and regsvr32 on workstations in the last 30 days, excluding known IT admin devices.”

// Copilot-generated: LOLBin usage hunting query
let lolbins = dynamic(["certutil.exe","bitsadmin.exe","mshta.exe",
    "regsvr32.exe","msbuild.exe","installutil.exe","cmstp.exe"]);
let itAdminDevices = IdentityInfo
| where Department == "IT" and JobTitle has "admin"
| distinct AccountName;
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ (lolbins)
| where InitiatingProcessAccountName !in (itAdminDevices)
| extend CmdLine = tolower(ProcessCommandLine)
| where CmdLine has_any ("http","ftp","\\\\","decode","-urlcache",
                          "/i:http","dll","javascript")
| summarize Count=count(), 
            Devices=make_set(DeviceName, 10),
            SampleCmds=make_set(ProcessCommandLine, 3)
  by FileName, InitiatingProcessAccountName
| where Count >= 2
| sort by Count desc

Finding: certutil.exe used to download and decode a payload on 3 medical imaging workstations. Analyst escalated to incident. discovered a compromised PACS (medical imaging) application.

Copilot Prompt: “Find service accounts that were dormant for 60+ days but became active in the last 7 days. Include what resources they accessed.”

// Hunt: Dormant service accounts reactivated
let serviceAccts = IdentityInfo
| where AccountName startswith "svc-" or AccountName startswith "sa-"
| distinct AccountUpn, AccountName;
let dormantPeriod = IdentityLogonEvents
| where Timestamp between (ago(67d) .. ago(7d))
| where AccountUpn in (serviceAccts)
| summarize LastActive = max(Timestamp) by AccountUpn
| where LastActive < ago(60d);
IdentityLogonEvents
| where Timestamp > ago(7d)
| where AccountUpn in (dormantPeriod)
| summarize ReactivationTime = min(Timestamp),
            LogonCount = count(),
            TargetDevices = make_set(DeviceName, 10),
            SourceIPs = make_set(IPAddress, 5) by AccountUpn
| join kind=inner dormantPeriod on AccountUpn
| extend DormantDays = datetime_diff('day', ReactivationTime, LastActive)
| project AccountUpn, DormantDays, ReactivationTime, LogonCount, 
          TargetDevices, SourceIPs

Finding: svc-radiology-backup (dormant 142 days) became active from an IP in Eastern Europe. Account was compromised via a password found in a leaked database. Immediate credential rotation and Entra ID CA policy applied.

Copilot Prompt: “Find users who accessed patient records outside their department in the last 14 days. Cross-reference IdentityInfo department with EMR access logs.”

// Hunt: Cross-department patient record access
CloudAppEvents
| where Timestamp > ago(14d)
| where Application == "Epic EMR" and ActionType == "PatientRecordView"
| extend PatientDepartment = tostring(RawEventData.PatientDept)
| join kind=inner (
    IdentityInfo | project AccountUpn, StaffDepartment=Department
) on $left.AccountUpn == $right.AccountUpn
| where PatientDepartment != StaffDepartment
| summarize CrossDeptViews = count(),
            PatientsViewed = dcount(tostring(RawEventData.PatientId)),
            Departments = make_set(PatientDepartment)
  by AccountUpn, StaffDepartment
| where CrossDeptViews > 20 // Threshold for investigation
| sort by CrossDeptViews desc

Finding: 2 billing department employees accessed 80+ oncology patient records (not part of their role). Investigation revealed they were selling patient data. HIPAA violation reported; employees terminated.

Copilot Prompt: “What unsanctioned cloud apps are employees using to share files? Show the apps, the volume of data uploaded, and which departments.”

Result: Copilot queries MDA Shadow IT discovery and returns: 14 unsanctioned file-sharing apps detected. Top 3: WeTransfer (2.4 GB uploaded, 45 users), personal Dropbox (1.8 GB, 23 users), mega.nz (900 MB, 8 users). HR and Research departments are highest users. 340 files with PHI were uploaded to unsanctioned services.

Action: MDA deployed session controls blocking uploads of sensitive content to unsanctioned apps. Purview DLP endpoint policy deployed to block file uploads to known non-compliant cloud services. Employee training scheduled.