critical KQL Entra ID

MFA Method Registered After a Risky Sign-In

Correlates a risky sign-in with an authentication-method registration minutes later - the fingerprint of account takeover establishing persistence.

Rule source

entra-mfa-method-added-post-signin.kql

// MFA Method Registered After Risky Sign-In
// T1098.005 - Account Manipulation: Device Registration
// The fingerprint of account takeover establishing persistence.

let lookback = 1h;
let correlation_window = 30m;

let risky_signins =
    SigninLogs
    | where TimeGenerated > ago(lookback)
    | where RiskLevelDuringSignIn in ("medium", "high")
         or RiskEventTypes_V2 has "impossibleTravel"
    | project
        SignInTime = TimeGenerated,
        UserPrincipalName,
        IPAddress,
        Location,
        RiskLevelDuringSignIn;

AuditLogs
| where TimeGenerated > ago(lookback)
| where Category == "UserManagement"
| where OperationName has_any (
      "User registered security info",
      "Add strong authentication method",
      "Register device")
| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)
| join kind=inner risky_signins on UserPrincipalName
| where TimeGenerated between (SignInTime .. (SignInTime + correlation_window))
| project
    TimeGenerated,
    UserPrincipalName,
    OperationName,
    SignInTime,
    IPAddress,
    Location,
    RiskLevelDuringSignIn
| order by TimeGenerated desc

Required telemetry

Entra ID SigninLogs + AuditLogs (Authentication Methods)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Employees travelling who enrol a new phone on arrival
VPN egress that geolocates inconsistently - tune named locations first

Validation

Tabletop with IAM: enrol a method from a VPN exit in another region

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.