Azure Sentinel threat hunting: six KQL notebooks for hybrid lateral movement
Each notebook pairs a hypothesis with the exact SigninLogs and DeviceLogonEvents joins that prove or kill it — impossible travel, dormant-account revival, Kerberoasting fallout, and three more.
Threat hunting works when you start from a hypothesis, not from a dashboard. These six notebooks each state one, then give the query that proves or kills it.
1. Impossible travel that conditional access missed
Conditional access blocks the obvious cases. The interesting ones are sign-ins that succeeded from two locations too far apart for the time between them, usually because a trusted-network exclusion covered one of them.
Join SigninLogs to itself on UserPrincipalName, compute the gap between consecutive sign-ins, and flag any pair whose distance over time exceeds a plausible speed. Exclude your VPN egress addresses or you will drown in false positives.
2. Dormant accounts waking up
An account with no interactive sign-in for ninety days that suddenly authenticates is worth a look, especially if the first action is a permission change. Build the baseline from SigninLogs, then anti-join today's activity against it.
3. Kerberoasting fallout
Kerberoasting happens on-premises but the consequences show up in the cloud. Look for service accounts that authenticate to Entra ID for the first time, or from a device that has never carried them before, using DeviceLogonEvents joined to IdentityLogonEvents.
4. Consent grants nobody requested
Cross-reference AuditLogs for the Consent to application operation against your change tickets. Anything unmatched is either shadow IT or an intrusion, and both need an answer.
5. Mailbox rules created shortly after a sign-in anomaly
Attackers set forwarding rules early. Join risky sign-ins to OfficeActivity mailbox-rule events within a short window and the pairs stand out sharply.
6. Privileged role assignments outside the change window
PIM activations at three in the morning are not always malicious, but they are always worth a sentence of explanation. Query AuditLogs for role assignment operations and bucket them by hour.
Making these stick
A hunt that runs once finds one thing. Save each query as a Sentinel hunting query, attach the hypothesis as the description so the next analyst knows what it is for, and promote the ones that keep producing into scheduled analytics rules.