Azure AD Audit Logs: Successful Password Reset by User Account

title: "Azure AD Audit Logs: Successful Password Reset by User Account"
id: 56f2be45-75d3-4b66-acaa-00e2a34122a5
status: test
description: This rule flags successful Azure AD audit log events in which a user performs a password reset. Password resets can be abused to regain access after credential theft or to establish persistence by replacing an existing credential. It relies on Azure audit log fields indicating successful UserManagement actions initiated by a user identifier and containing the activity text for a password reset.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_user_password_change.yml
author: YochanaHenderson, '@Yochana-H', Huntrule Team
date: 2022-08-03
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.credential-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    Category: UserManagement
    Status: Success
    Initiatedby: UPN
  filter:
    Target|contains: UPN
    ActivityType|contains: Password reset
  condition: selection and filter
falsepositives:
  - If this was approved by System Administrator or confirmed user action.
level: medium
license: DRL-1.1
related:
  - id: 340ee172-4b67-4fb4-832f-f961bdc1f3aa
    type: derived