admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

improving detections

Browse Source
This commit is contained in:
mvelazco
2022-08-29 11:46:57 -04:00
parent d9226071a7
commit 024337cf62
2 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
+2 -2
View File
@@ -5,8 +5,8 @@ date: '2022-07-14'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary
trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. '
description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge.
Error Code 500121 represents a failed attempt to authenticate using a second factor. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. '
search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
| rename body.properties.* as *
| stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent
detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
+7 -5
View File
@@ -5,13 +5,15 @@ date: '2022-08-25'
author: Mauricio Velazco, Splunk
type: Anomaly
datamodel: []
description: 'The following analytic identifies multiple failed multi-factor authentication requests for a user within an Azure AD tenant. Specifically, the analytic looks for more than 10 failed MFA user prompts.
This behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeat login attempts in order to bombard users with MFA push notifications
potentially resulting in the user finally accepting the authentication request. Security teams should test this detection and customize the arbitrary threshold when needed.
Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass mult-factor authentication controls as reported by Mandiant and others.'
description: 'The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor.
Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds.
The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls
potentially resulting in the user finally accepting the authentication request.
Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.'
search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
| rename body.properties.* as *
| stats dc(_time) AS mfa_prompts values(userPrincipalName) by userPrincipalName, ipAddress, status.additionalDetails, appDisplayName, userAgent
| bucket span=10m _time
| stats dc(_raw) AS mfa_prompts values(userPrincipalName) by userPrincipalName, status.additionalDetails, appDisplayName, userAgent, _time
| where mfa_prompts > 10
| `azure_ad_multiple_failed_mfa_requests_for_user_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).