Skip to content

Instantly share code, notes, and snippets.

@dirkjanm

dirkjanm/guestinvite.kql

Last active August 17, 2022 23:50
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dirkjanm/814b4fcd75f0c0f13f5c05b7edbee794 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dirkjanm/814b4fcd75f0c0f13f5c05b7edbee794 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. dirkjanm revised this gist Jul 26, 2022. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions guestinvite.kql
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    // Guest invite abuse hunting
    // Query by @_dirkjan / Outsider Security - released as CC BY (https://creativecommons.org/licenses/by/2.0/)
    AuditLogs
    | where OperationName =~ "Update user"
    | where Result =~ "success"
  2. dirkjanm created this gist Jul 26, 2022.
    18 changes: 18 additions & 0 deletions guestinvite.kql
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    AuditLogs
    | where OperationName =~ "Update user"
    | where Result =~ "success"
    | mv-expand target = TargetResources
    | where tostring(InitiatedBy.user.userPrincipalName) has "@" or tostring(InitiatedBy.app.displayName) has "@"
    | extend targetUPN = tostring(TargetResources[0].userPrincipalName)
    | extend targetId = tostring(TargetResources[0].id)
    | extend targetType = tostring(TargetResources[0].type)
    | extend modifiedProps = TargetResources[0].modifiedProperties
    | extend initiatedUser = tostring(InitiatedBy.user.userPrincipalName)
    | mv-expand modifiedProps
    | where modifiedProps.displayName =~ "UserState"
    | mv-expand AdditionalDetails
    | where AdditionalDetails.key =~ "UserType" and AdditionalDetails.value =~ "Guest"
    | extend new_value_set = parse_json(tostring(modifiedProps.newValue))
    | extend old_value_set = parse_json(tostring(modifiedProps.oldValue))
    | where new_value_set[0] =~ "Accepted" and old_value_set[0] =~ "PendingAcceptance"
    | project-away old_value_set, new_value_set, modifiedProps