Investigate behaviors with advanced hunting (Preview)

Article
01/22/2024

While some anomaly detections focus primarily on detecting problematic security scenarios, others can help identifying and investigating anomalous user behavior that doesn't necessarily indicate a compromise. In such cases, Microsoft Defender for Cloud Apps uses a separate data type, called behaviors.

This article describes how to investigate Defender for Cloud Apps behaviors with Microsoft Defender XDR advanced hunting.

Have feedback to share? Fill out our feedback form!

What is a behavior?

Behaviors are attached to MITRE attack categories and techniques, and provide a deeper understanding about an event than is provided by the raw event data. Behavior data lies between raw event data and the alerts generated by an event.

While behaviors might be related to security scenarios, they're not necessarily a sign of malicious activity or a security incident. Each behavior is based on one or more raw events, and provides contextual insights into what occurred at a specific time, using information that Defender for Cloud Apps as learned or identified.

Supported detections

Behaviors currently support low-fidelity, Defender for Cloud Apps detections, that may not meet the standard for alerts but are still useful in providing context during an investigation. Currently supported detections include:

Alert name	Policy name
Activity from infrequent country	Activity from infrequent country/region
Impossible travel activity	Impossible travel
Mass delete	Unusual file deletion activity (by user)
Mass download	Unusual file download (by user)
Mass share	Unusual file share activity (by user)
Multiple delete VM activities	Multiple delete VM activities
Multiple failed login attempts	Multiple failed sign-in attempts
Multiple Power BI report sharing activities	Multiple Power BI report sharing activities
Multiple VM creation activities	Multiple VM creation activities
Suspicious administrative activity	Unusual administrative activity (by user)
Suspicious impersonated activity	Unusual impersonated activity (by user)
Suspicious OAuth app file download activities	Suspicious OAuth app file download activities
Suspicious Power BI report sharing	Suspicious Power BI report sharing
Unusual addition of credentials to an OAuth app	Unusual addition of credentials to an OAuth app

Defender for Cloud Apps' transition from alerts to behaviors

To enhance the quality of alerts generated by Defender for Cloud Apps, and lower the number of false positives, Defender for Cloud Apps is currently transitioning security content from alerts to behaviors.

This process aims to remove policies from alerts that give low-quality detections, while still creating security scenarios that focus on out-of-the-box detections. In parallel, Defender for Cloud Apps sends behaviors to aid you in your investigations.

The transition process from alerts to behaviors includes the following phases:

(Complete) Defender for Cloud Apps sends behaviors in parallel to alerts.
(Currently in Preview) Policies that generate behaviors are now disabled by default, and don't send alerts.
Move to a cloud-managed detection model, removing customer-facing policies completely. This phase is planned to provide both custom detections and selected alerts generated by internal policies for high-fidelity, security-focused scenarios.

The transition to behaviors also includes enhancements for supported behavior types and adjustments for policy-generated alerts for optimal accuracy.

Note

The scheduling of the last phase is undetermined. Customers will be notified of any changes through notifications in the Message Center.

For more information, see our TechCommunity blog.

Using behaviors in Microsoft Defender XDR advanced hunting

Access behaviors in the Microsoft Defender XDR Advanced hunting page, and use behaviors by querying behavior tables and creating custom detection rules that include behavior data.

The behaviors schema in the Advanced hunting page is similar to the alerts schema, and includes the following tables:

Table name	Description
BehaviorInfo	Record per behavior with its metadata, including behavior title, MITRE Attack categories, and techniques.
BehaviorEntities	Information on the entities that were part of the behavior. Can be multiple records per behavior.

To get complete information on a behavior and its entities, use BehaviorId as the primary key for the join. For example:

BehaviorInfo
| where BehaviorId == "INSERT VALUE"
| join BehaviorEntities on BehaviorId

Sample scenarios

This section provides sample scenarios for using behavior data in the Microsoft Defender XDR Advanced hunting page, and relevant code samples.

Tip

Create custom detection rules for any detection that you want to continue appearing as an alert, if an alert no longer is generated by default.

Get alerts for mass downloads

Scenario: You want to be alerted when a mass download is done by a specific user or a list of users that are prone to be compromised or to internal risk.

To do so, create a custom detection rule based on the following query:

BehaviorEntities
| where ActionType == "MassDownload" 
| where EntityType == “User” and AccountName in (“username1”, “username2”…  )

For more information, see Create and manage custom detection rules in Microsoft Defender XDR.

Query 100 recent behaviors

Scenario: You want to query 100 recent behaviors related to the MITRE attack technique Valid Accounts (T1078).

Use the following query:

BehaviorInfo
| where AttackTechniques has "Valid Accounts (T1078)"
| order by Timestamp desc 
| take 100

Investigate behaviors for a specific user

Scenario: Investigate all behaviors related to a specific user after understanding the user may have been compromised.

Use the following query, where username is the name of the user you want to investigate:

BehaviorInfo
| where ServiceSource == "Microsoft Cloud App Security"
| where AccountUpn == "*username*"
| join BehaviorEntities on BehaviorId
| project Timestamp, BehaviorId, ActionType, Description, Categories, AttackTechniques, ServiceSource, AccountUpn, AccountObjectId, EntityType, EntityRole, RemoteIP, AccountName, AccountDomain, Application

Investigate behaviors for a specific IP address

Scenario: Investigate all behaviors where one of the entities is a suspicious IP address.

Use the following query, where suspicious IP* is the IP you want to investigate.

BehaviorEntities
| where EntityType == "Ip"
| where RemoteIP == "*suspicious IP*"
| where ServiceSource == "Microsoft Cloud App Security"
| project Timestamp, BehaviorId, ActionType, Categories, ServiceSource, AccountUpn, AccountObjectId, EntityType, EntityRole, RemoteIP, AccountName, AccountDomain

Next steps

If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket..