From 0a197e5431ccbc2b70aaae1cfd702ccdfa3ae6ca Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 17 Oct 2023 16:34:30 -0400 Subject: [PATCH] updating detection, adding new one. adding new stories --- ...of_login_failures_from_a_single_source.yml | 17 ++++--- ...applicationimpersonation_role_assigned.yml | 50 +++++++++++++++++++ ...ber_of_failed_authentications_for_user.yml | 2 +- ...ed_application_consent_granted_by_user.yml | 2 +- ...box_inbox_folder_shared_with_all_users.yml | 2 +- ...box_read_access_granted_to_application.yml | 2 +- ..._users_failing_to_authenticate_from_ip.yml | 2 +- ..._consent_blocked_for_risky_application.yml | 2 +- ...r_consent_denied_for_oauth_application.yml | 2 +- stories/o365_compromised_identity_abuse.yml | 19 +++++++ .../o365_identity_compromise_techniques.yml | 19 +++++++ 11 files changed, 104 insertions(+), 15 deletions(-) create mode 100644 detections/cloud/o365_applicationimpersonation_role_assigned.yml create mode 100644 stories/o365_compromised_identity_abuse.yml create mode 100644 stories/o365_identity_compromise_techniques.yml diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml index 24a78bd5a0..e6d123001a 100644 --- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/cloud/high_number_of_login_failures_from_a_single_source.yml @@ -5,22 +5,23 @@ date: '2020-12-16' author: Bhavin Patel, Mauricio Velazco, Splunk status: production type: Anomaly -description: This search will detect more than 5 login failures in Office365 Azure - Active Directory from a single source IP address. Please adjust the threshold value - of 5 as suited for your environment. +description: This analytic detects multiple failed login attempts in Office365 Azure Active Directory from a single source IP address. Specifically, it identifies scenarios where there are more than 5 unsuccessful login attempts within a short time frame. The detection leverages Office365 management activity logs, specifically the AzureActiveDirectoryStsLogon records from the AzureActiveDirectory workload. It aggregates these logs in 5-minute intervals to count the number of failed login attempts and associates them with the originating source IP address. Multiple failed login attempts from a single source can be indicative of brute-force attacks, password spraying, or other malicious authentication attempts. Identifying and responding to these patterns promptly can prevent unauthorized access and potential breaches. If this detection represents a true positive, an attacker might be attempting to gain unauthorized access to an Office365 account. Successful compromise could lead to unauthorized access to sensitive data, potential lateral movement within the organization, or further malicious activities using the compromised account. data_source: [] search: '`o365_management_activity` Workload=AzureActiveDirectory Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon | bucket span=5m _time | stats dc(_raw) AS failed_attempts values(user) as user values(LogonError) as LogonError values(signature) as signature values(UserAgent) as UserAgent by _time, src_ip | where failed_attempts > 10 | `high_number_of_login_failures_from_a_single_source_filter`' -how_to_implement: '' -known_false_positives: An Ip address with more than 20 failed authentication attempts - in the span of 5 minutes may also be triggered by a broken application. -references: [] +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. Adjust the threshold value to suit the specific environment, as environments with naturally higher login failures might generate false positives at a lower threshold. +known_false_positives: An Ip address with more than 10 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. +references: +- https://attack.mitre.org/techniques/T1110/001/ +- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray +- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a +- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes tags: analytic_story: - - Office 365 Detections + - O365 Identity Compromise Techniques asset_type: Office 365 confidence: 50 impact: 50 diff --git a/detections/cloud/o365_applicationimpersonation_role_assigned.yml b/detections/cloud/o365_applicationimpersonation_role_assigned.yml new file mode 100644 index 0000000000..037d605a3f --- /dev/null +++ b/detections/cloud/o365_applicationimpersonation_role_assigned.yml @@ -0,0 +1,50 @@ +name: O365 ApplicationImpersonation Role Assigned +id: 49cdce75-f814-4d56-a7a4-c64ec3a481f2 +version: 1 +date: '2023-10-17' +author: Mauricio Velazco, Splunk +status: production +type: TTP +data_source: [] +description: UPDATE_DESCRIPTION +search: '`o365_management_activity` Workload=Exchange Operation="New-ManagementRoleAssignment" Role=ApplicationImpersonation + | stats max(_time) as lastTime by Operation, user, object, ObjectId, Role + | `security_content_ctime(lastTime)` + | `o365_applicationimpersonation_role_assigned_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1098/002/ +- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452 +- https://www.mandiant.com/media/17656 +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: Office 365 + atomic_guid: + - UPDATE atomic_guid + confidence: 70 + impact: 80 + message: UPDATE message + mitre_attack_id: + - T1098 + - T1098.002 + observable: + - name: user + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 56 + required_fields: + - UPDATE_required_fields + security_domain: audit +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/application_impersonation_role_assigned/application_impersonation_role_assigned.log + source: O365 + sourcetype: o365:management:activity diff --git a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml index 5ee408d955..c6d9ef013f 100644 --- a/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/o365_high_number_of_failed_authentications_for_user.yml @@ -19,7 +19,7 @@ references: - https://attack.mitre.org/techniques/T1110/001/ tags: analytic_story: - - UPDATE_STORY_NAME + - O365 Identity Compromise Techniques asset_type: O365 tenant confidence: 70 impact: 50 diff --git a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml index 499b334683..2c3fca67c4 100644 --- a/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml +++ b/detections/cloud/o365_mail_permissioned_application_consent_granted_by_user.yml @@ -25,7 +25,7 @@ references: - REFERENCE tags: analytic_story: - - UPDATE_STORY_NAME + - O365 Identity Compromise Techniques asset_type: UPDATE asset_type atomic_guid: - UPDATE atomic_guid diff --git a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml index 9b9f5302d2..660eeac420 100644 --- a/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml +++ b/detections/cloud/o365_mailbox_inbox_folder_shared_with_all_users.yml @@ -19,7 +19,7 @@ references: - https://www.blackhillsinfosec.com/abusing-exchange-mailbox-permissions-mailsniper/ tags: analytic_story: - - UPDATE_STORY_NAME + - O365 Compromised Identity Abuse asset_type: Office 365 Tenant confidence: 70 impact: 80 diff --git a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml index 2838713239..a1ae7b2a16 100644 --- a/detections/cloud/o365_mailbox_read_access_granted_to_application.yml +++ b/detections/cloud/o365_mailbox_read_access_granted_to_application.yml @@ -35,7 +35,7 @@ references: - https://graphpermissions.merill.net/permission/Mail.Read tags: analytic_story: - - UPDATE_STORY_NAME + - O365 Compromised Identity Abuse asset_type: Office 365 tenant confidence: 50 impact: 90 diff --git a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml index d7d8897221..65c3a8639d 100644 --- a/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/o365_multiple_users_failing_to_authenticate_from_ip.yml @@ -21,7 +21,7 @@ references: - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes tags: analytic_story: - - UPDATE_STORY_NAME + - O365 Identity Compromise Techniques asset_type: Office 365 tenant atomic_guid: - UPDATE atomic_guid diff --git a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml index 2e7d8811a6..56bc22bf5b 100644 --- a/detections/cloud/o365_user_consent_blocked_for_risky_application.yml +++ b/detections/cloud/o365_user_consent_blocked_for_risky_application.yml @@ -23,7 +23,7 @@ references: - REFERENCE tags: analytic_story: - - UPDATE_STORY_NAME + - O365 Identity Compromise Techniques asset_type: O365 tenant atomic_guid: - UPDATE atomic_guid diff --git a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml index d2e459bf88..fb4c8f3147 100644 --- a/detections/cloud/o365_user_consent_denied_for_oauth_application.yml +++ b/detections/cloud/o365_user_consent_denied_for_oauth_application.yml @@ -19,7 +19,7 @@ references: - REFERENCE tags: analytic_story: - - UPDATE_STORY_NAME + - O365 Identity Compromise Techniques asset_type: O365 tenant confidence: 100 impact: 30 diff --git a/stories/o365_compromised_identity_abuse.yml b/stories/o365_compromised_identity_abuse.yml new file mode 100644 index 0000000000..54db4c8a9a --- /dev/null +++ b/stories/o365_compromised_identity_abuse.yml @@ -0,0 +1,19 @@ +name: O365 Compromised Identity Abuse +id: f2c72a90-e7ea-4819-91c7-8fc0f0faa940 +version: 1 +date: '2023-10-17' +author: Mauricio Velazco, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + analytic_story: O365 Compromised Identity Abuse + category: + - Adversary Tactics + - Account Compromise + - Cloud Security + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/o365_identity_compromise_techniques.yml b/stories/o365_identity_compromise_techniques.yml new file mode 100644 index 0000000000..24c621302e --- /dev/null +++ b/stories/o365_identity_compromise_techniques.yml @@ -0,0 +1,19 @@ +name: O365 Identity Compromise Techniques +id: 3d69980c-193b-4790-935c-5a9ef085dc60 +version: 1 +date: '2023-10-17' +author: Mauricio Velazco, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + analytic_story: O365 Identity Compromise Techniques + category: + - Adversary Tactics + - Account Compromise + - Cloud Security + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection