Βιβλιοθήκη KQL για ΚΥΑ 1689/2025, NIS2 και ISO 27001

// Sign-ins με legacy authentication, τελευταίες 30 ημέρες
// ΚΥΑ 1689/2025: 13.ζ, 19.η
let LegacyClients = dynamic(["Exchange ActiveSync", "IMAP4", "POP3", "Authenticated SMTP",
    "Exchange Web Services", "MAPI Over HTTP", "Offline Address Book",
    "Outlook Anywhere (RPC over HTTP)", "Exchange Online PowerShell",
    "Autodiscover", "Other clients"]);
EntraIdSignInEvents
| where Timestamp > ago(30d)
| where ClientAppUsed in (LegacyClients)
| summarize
    Successful = countif(ErrorCode == 0),
    Failed = countif(ErrorCode != 0),
    LastSeen = max(Timestamp),
    IPs = make_set(IPAddress, 10),
    Countries = make_set(Country, 10)
    by AccountUpn, ClientAppUsed, Application
| order by Successful desc, Failed desc

// Αναθέσεις ρόλων στο Entra ID, τελευταίες 30 ημέρες
// ΚΥΑ 1689/2025: 13.γ, 13.δ, 24.γ
let PrivilegedRoles = dynamic(["Global Administrator", "Privileged Role Administrator",
    "Privileged Authentication Administrator", "Security Administrator",
    "Exchange Administrator", "SharePoint Administrator", "User Administrator",
    "Application Administrator", "Cloud Application Administrator",
    "Conditional Access Administrator", "Intune Administrator",
    "Hybrid Identity Administrator"]);
CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType has "member to role"
| extend MP = tostring(RawEventData.ModifiedProperties)
| extend RoleName = extract(@'"Name":"Role\.DisplayName","NewValue":"([^"]*)"', 1, MP)
| extend
    Actor = tostring(RawEventData.UserId),
    TargetUser = tostring(RawEventData.ObjectId),
    Result = tostring(RawEventData.ResultStatus),
    IsPrivileged = RoleName in (PrivilegedRoles)
| project Timestamp, ActionType, Actor, TargetUser, RoleName, IsPrivileged, Result, IPAddress
| order by IsPrivileged desc, Timestamp desc

// Χρήση αφαιρούμενων μέσων USB, τελευταίες 30 ημέρες
// ΚΥΑ 1689/2025: 11.δ, 24.γ
let Lookback = 30d;
let Mounts = DeviceEvents
| where Timestamp > ago(Lookback)
| where ActionType == "UsbDriveMounted"
| extend AF = parse_json(AdditionalFields)
| project MountTime = Timestamp, DeviceId, DeviceName,
    DriveLetter = tostring(AF.DriveLetter), Manufacturer = tostring(AF.Manufacturer),
    Product = tostring(AF.ProductName), SerialNumber = tostring(AF.SerialNumber)
| where not(Product matches regex @"(?i)(CD|DVD|ROM|VIRTUAL|VMWARE)");
Mounts
| join kind=leftouter (
    DeviceInfo
    | where Timestamp > ago(Lookback + 1d)
    | where isnotempty(LoggedOnUsers) and LoggedOnUsers != "[]"
    | project InfoTime = Timestamp, DeviceId, LoggedOnUsers
  ) on DeviceId
| where isnull(InfoTime) or InfoTime <= MountTime
| summarize arg_max(InfoTime, LoggedOnUsers)
    by MountTime, DeviceName, DriveLetter, Manufacturer, Product, SerialNumber
| extend LoggedOnUser = tostring(parse_json(LoggedOnUsers)[0].UserName)
| project MountTime, DeviceName, LoggedOnUser, DriveLetter, Manufacturer, Product, SerialNumber
| order by MountTime desc

// Phishing και malware που παραδόθηκαν και αφαιρέθηκαν εκ των υστέρων από το ZAP, τελευταίες 30 ημέρες
// ΚΥΑ 1689/2025: 20.γ, 24.ε
let Lookback = 30d;
EmailPostDeliveryEvents
| where Timestamp > ago(Lookback)
| where ActionType in ("Phish ZAP", "Malware ZAP")
| project ZapTime = Timestamp, NetworkMessageId, RecipientEmailAddress,
    ActionType, Action, ActionResult
| join kind=inner (
    EmailEvents
    | where Timestamp > ago(Lookback)
    | where DeliveryAction == "Delivered"
    | project DeliveredTime = Timestamp, NetworkMessageId, RecipientEmailAddress,
        SenderFromAddress, Subject, DeliveryLocation
  ) on NetworkMessageId, RecipientEmailAddress
| extend MinutesInMailbox = datetime_diff('minute', ZapTime, DeliveredTime)
| project DeliveredTime, ZapTime, MinutesInMailbox, RecipientEmailAddress,
    SenderFromAddress, Subject, DeliveryLocation, ActionType, Action, ActionResult
| order by MinutesInMailbox desc