Account Access Removal — Entra ID Mass Password Reset and Account Disablement for Extortion Lockout

// THREAT-EntraID-ExtortionLockout (T1531 Account Access Removal - Entra ID control plane)
let Lookback = 2h;
let BurstWindow = 15m;
let MinDistinctTargets = 5;
AuditLogs
| where TimeGenerated > ago(Lookback)
| where OperationName in ("Reset password (by admin)", "Change user password", "Disable account", "Delete user")
| where Result == "success"
| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingApp = tostring(InitiatedBy.app.displayName)
| extend Initiator = iif(isnotempty(InitiatingUser), InitiatingUser, InitiatingApp)
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| where isnotempty(TargetUser)
| summarize ActionCount = count(), DistinctTargets = dcount(TargetUser), Actions = make_set(OperationName), TargetSample = make_set(TargetUser, 15) by Initiator, bin(TimeGenerated, BurstWindow)
| where DistinctTargets >= MinDistinctTargets
| sort by DistinctTargets desc, TimeGenerated desc

index=azuread sourcetype="mscs:azure:aad"
(operationName="Reset password (by admin)" OR operationName="Change user password" OR operationName="Disable account" OR operationName="Delete user")
result="success"
| eval Initiator=coalesce('initiatedBy.user.userPrincipalName', 'initiatedBy.app.displayName')
| eval TargetUser=mvindex('targetResources{}.userPrincipalName', 0)
| where isnotnull(TargetUser)
| bin _time span=15m
| stats count as ActionCount, dc(TargetUser) as DistinctTargets, values(operationName) as Actions, values(TargetUser) as TargetSample by Initiator, _time
| where DistinctTargets >= 5
| sort - DistinctTargets

sequence by azure.auditlogs.identity with maxspan=15m
  [any where event.dataset == "azure.auditlogs" and azure.auditlogs.operation_name : ("Reset password (by admin)", "Change user password") and event.outcome == "success"]
  [any where event.dataset == "azure.auditlogs" and azure.auditlogs.operation_name : ("Reset password (by admin)", "Change user password", "Disable account", "Delete user") and event.outcome == "success"]
  [any where event.dataset == "azure.auditlogs" and azure.auditlogs.operation_name : ("Reset password (by admin)", "Change user password", "Disable account", "Delete user") and event.outcome == "success"]

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  "Event Name" AS OperationName,
  "Initiated By" AS Initiator,
  "Target User" AS TargetUser
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) ILIKE '%Azure AD%'
  AND "Event Name" IN ('Reset password (by admin)', 'Change user password', 'Disable account', 'Delete user')
  AND UTF8(payload) ILIKE '%success%'
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory="azure/aad/audit"
operationName in ("Reset password (by admin)", "Change user password", "Disable account", "Delete user")
result="success"
| json field=_raw "initiatedBy.user.userPrincipalName" as InitiatorUser nodrop
| json field=_raw "initiatedBy.app.displayName" as InitiatorApp nodrop
| json field=_raw "targetResources[0].userPrincipalName" as TargetUser nodrop
| eval Initiator=if(isEmpty(InitiatorUser), InitiatorApp, InitiatorUser)
| where !isEmpty(TargetUser)
| timeslice 15m
| stats count as ActionCount, dc(TargetUser) as DistinctTargets, values(operationName) as Actions by Initiator, _timeslice
| where DistinctTargets >= 5
| sort by DistinctTargets desc

rule entra_id_extortion_lockout {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects a single identity performing password resets and/or deletions against many distinct Entra ID user accounts within a short window, consistent with extortion-driven lockout"
    reference = "https://attack.mitre.org/techniques/T1531/"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1531"
    false_positives = "Scheduled HR offboarding, break-glass reset campaigns, Lifecycle Workflows, tenant consolidation"
    version = "1.0"

  events:
    $e.metadata.event_type = "USER_CHANGE_PASSWORD" or $e.metadata.event_type = "USER_DELETION"
    $e.metadata.product_name = "Microsoft Entra ID"
    $e.security_result.action = "ALLOW"
    $initiator = $e.principal.user.userid
    $target = $e.target.user.userid

  match:
    $initiator over 15m

  outcome:
    $distinct_targets = count_distinct($target)

  condition:
    $e and $distinct_targets >= 5
}

#repo=azuread_audit
operationName=/^(Reset password \(by admin\)|Change user password|Disable account|Delete user)$/
result="success"
| Initiator := coalesce(field=["initiatedBy.user.userPrincipalName", "initiatedBy.app.displayName"])
| TargetUser := "targetResources[0].userPrincipalName"
| test(TargetUser!="")
| groupBy([Initiator], function=[count(as=ActionCount), distinct(TargetUser, as=DistinctTargets), collect(operationName, limit=20)])
| test(DistinctTargets >= 5)
| sort(DistinctTargets, order=desc)