Forum Discussion
The leaver who never left: tuning a Sentinel detection from 103 rows to one alert
Most account compromise detections look for something odd: a new country, an impossible journey, or a sign-in at 3 AM. I wanted to catch a case where nothing looks odd at all. Someone leaves the ...
Nice write-up, and the re-enable rule is the part I'd copy first. One thing for the incident side is the 7 day lookback. If someone has been getting in for three weeks, FirstSeen still only shows a week ago, so I'd add a hunting query that goes back to the LeaveDate as far as the workspace keeps SigninLogs. That first sign-in after leaving is the time to work from when checking what the account touched, and when picking the recommended recovery point for anything it could change.
Disclosure: I work at CyberSnap.