Data Source

PRODAFT USTA is a threat intelligence platform focused on compromised corporate credentials sourced from infostealer malware campaigns. This solution ingests data from the USTA Account Takeover Prevention (ATP) API, which provides structured tickets for each compromised credential event including affected identity, company, source, and password-strength signals.

Plaintext passwords are never written to the workspace: the DCR transform drops them at ingestion and retains only PasswordScore and PasswordLength.

Ingestion Mechanism

  • Connector type: CCF (Codeless Connector Framework) with DCR-based ingestion
  • Polling interval: Every minute (forward-only from connection time)
  • Target table: PRODAFTUstaCompromisedCredentials_CL
  • Parser function: PRODAFTUstaCompromisedCredentials – query-time deduplication on TicketId (use this instead of the raw _CL table to avoid duplicates from backfill overlap)
  • Historical backfill: Dedicated Playbook (PRODAFTUstaATP-Backfill) using the Logs Ingestion API via managed identity; pages up to 1,000 pages (configurable BackfillDays). TimeGenerated is set at ingestion time; true event timestamp is preserved in Created – backfilled records appear on their correct historical dates and do not trigger alert storms.

Analytic Rules (2 added)

Corporate Credential Compromised

  • Fires when a new compromised-credential ticket arrives for a corporate identity in the PRODAFTUstaCompromisedCredentials_CL table.
  • Covers T1555 (Credentials from Password Stores) – credential harvesting via infostealer.

Compromised Credential Used in Successful Sign-In

  • Correlates USTA compromised-credential tickets against SigninLogs to detect successful Entra ID authentications using an already-known-compromised credential.
  • Covers T1078 (Valid Accounts) – adversary use of stolen credentials post-compromise.
  • This is the higher-fidelity signal: it fires only when the credential has demonstrably been used.

Hunting Query (1 added)

Infostealer Exposure Across Corporate Identities

  • Aggregates USTA ticket data by company and identity to surface the breadth of infostealer exposure across the corporate estate.
  • KQL logic unavailable – YAML not included in diff context beyond file listing.

MITRE Coverage

TechniqueTacticRule
T1555 – Credentials from Password StoresCredential AccessCorporate Credential Compromised
T1078 – Valid AccountsDefense Evasion, Persistence, Initial AccessCompromised Credential Used in Successful Sign-In

Operational Notes

  • The CCF connector polls forward only. Deploy the PRODAFTUstaATP-Backfill playbook and run it once to load historical tickets. The Playbook requires Monitoring Metrics Publisher on the DCR resource scope – RBAC propagation may take up to a minute; a 403 on first run is expected.
  • The ARM template (azuredeploy.json) for the backfill playbook sets principalType: ServicePrincipal on the DCR role assignment – required for correct managed identity RBAC resolution.
  • Query PRODAFTUstaCompromisedCredentials (the parser function) rather than PRODAFTUstaCompromisedCredentials_CL directly; the parser deduplicates at query time.

Affected Files

.script/tests/KqlvalidationsTests/CustomFunctions/PRODAFTUstaCompromisedCredentials.json
.script/tests/KqlvalidationsTests/CustomTables/PRODAFTUstaCompromisedCredentials_CL.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Logos/PRODAFTUstaATP.svg
Solutions/PRODAFT USTA - Account Takeover Prevention/Analytic Rules/CompromisedCredentialUsedInSignin.yaml
Solutions/PRODAFT USTA - Account Takeover Prevention/Analytic Rules/CorporateCredentialCompromised.yaml
Solutions/PRODAFT USTA - Account Takeover Prevention/Data Connectors/PRODAFTUstaATP_ccp/PRODAFTUstaATP_ConnectorDefinition.json
Solutions/PRODAFT USTA - Account Takeover Prevention/Data Connectors/PRODAFTUstaATP_ccp/PRODAFTUstaATP_DCR.json
Solutions/PRODAFT USTA - Account Takeover Prevention/Data Connectors/PRODAFTUstaATP_ccp/PRODAFTUstaATP_PollingConfig.json
Solutions/PRODAFT USTA - Account Takeover Prevention/Data Connectors/PRODAFTUstaATP_ccp/PRODAFTUstaATP_Table.json
Solutions/PRODAFT USTA - Account Takeover Prevention/Hunting Queries/InfostealerExposureByCompany.yaml
Solutions/PRODAFT USTA - Account Takeover Prevention/Package/testParameters.json
Solutions/PRODAFT USTA - Account Takeover Prevention/Parsers/PRODAFTUstaCompromisedCredentials.yaml
Solutions/PRODAFT USTA - Account Takeover Prevention/Playbooks/PRODAFTUstaATP-Backfill/azuredeploy.json
Solutions/PRODAFT USTA - Account Takeover Prevention/Playbooks/PRODAFTUstaATP-Backfill/readme.md
Solutions/PRODAFT USTA - Account Takeover Prevention/README.md
Solutions/PRODAFT USTA - Account Takeover Prevention/Workbooks/PRODAFTUstaATPOverview.json
Workbooks/Images/Logos/PRODAFTUstaATP.svg
Workbooks/Images/Preview/PRODAFTUstaATPBlack1.png
Workbooks/Images/Preview/PRODAFTUstaATPBlack2.png
Workbooks/Images/Preview/PRODAFTUstaATPWhite1.png
Workbooks/Images/Preview/PRODAFTUstaATPWhite2.png
Workbooks/WorkbooksMetadata.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_PRODAFTUstaATP.json, createUiDefinition.json, mainTemplate.json)