From 5579f1ebdbf77feb8e9af43cb775efbfd481de97 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 10 Aug 2022 13:34:18 -0400 Subject: [PATCH 1/5] adding new detection --- ...d_multi_factor_authentication_disabled.yml | 48 +++++++++++++++++++ ...ti_factor_authentication_disabled.test.yml | 13 +++++ 2 files changed, 61 insertions(+) create mode 100644 detections/cloud/azure_ad_multi_factor_authentication_disabled.yml create mode 100644 tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml new file mode 100644 index 0000000000..e77114ea21 --- /dev/null +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -0,0 +1,48 @@ +name: Azure AD Multi-Factor Authentication Disabled +id: 482dd42a-acfa-486b-a0bb-d6fcda27318e +version: 1 +date: '2022-08-10' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: '| UPDATE_SPL | `azure_ad_multi_factor_authentication_disabled_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- REFERENCE +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: UPDATE asset_type + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: UPDATE value between 1-100 + context: + - Update context + dataset: + - UPDATE_DATASET_URL + impact: UPDATE value between 1-100 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: UPDATE + type: UPDATE + role: + - UPDATE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - UPDATE + risk_score: UPDATE (impact * confidence)/100 + security_domain: identity diff --git a/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml b/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml new file mode 100644 index 0000000000..9314e3a0c9 --- /dev/null +++ b/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Multi-Factor Authentication Disabled Unit Test +tests: +- name: Azure AD Multi-Factor Authentication Disabled + file: cloud/azure_ad_multi_factor_authentication_disabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true From 6759feccd4f098261630205f1b354c2253dc0027 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Mon, 15 Aug 2022 17:22:54 -0400 Subject: [PATCH 2/5] Add Azure AD Multi-Factor Authentication Disabled --- ...d_multi_factor_authentication_disabled.yml | 47 ++++++++++++------- ...ti_factor_authentication_disabled.test.yml | 8 ++-- 2 files changed, 34 insertions(+), 21 deletions(-) diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index e77114ea21..2860f82403 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -5,44 +5,57 @@ date: '2022-08-10' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION -search: '| UPDATE_SPL | `azure_ad_multi_factor_authentication_disabled_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +description: The following analytic identifies an attempt to disable the MFA for a user. The attackers may disbale MFA after they acquire the credentials for the password. + This way the attackers can keep persistance in the environment without adding new users. Sometimes, the MFA may be disbaled by administrator for genuine purposes. +search: '`azuread` | spath "body.operationName" | search "body.operationName"="Disable Strong Authentication" + | rename body.properties.* as * | spath "body.properties.targetResources{}.userPrincipalName" | rename initiatedBy.user.ipAddress as ipAddress + | stats values(body.properties.targetResources{}.userPrincipalName) as userPrincipalName by _time, userAgent, ipAddress | `azure_ad_multi_factor_authentication_disabled_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents + log category. +known_false_positives: Legitimate users may disable MFA for debugging or testing. references: -- REFERENCE +- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +- https://attack.mitre.org/tactics/TA0005/ tags: analytic_story: - - UPDATE_STORY_NAME - asset_type: UPDATE asset_type + - Azure Active Directory Account Takeover + asset_type: Azure Active Directory cis20: - CIS 3 - CIS 5 - CIS 16 - confidence: UPDATE value between 1-100 + confidence: 90 context: - - Update context + - Source:Cloud Data + - Stage:Initial Access dataset: - - UPDATE_DATASET_URL - impact: UPDATE value between 1-100 + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/azuread/azure-audit.log + impact: 60 kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: MFA disabled for User $body.properties.targetResources{}.userPrincipalName$ mitre_attack_id: - T1003.002 nist: - DE.CM observable: - - name: UPDATE - type: UPDATE + - name: userPrincipalName + type: User role: - - UPDATE + - Victim + - name: ipAddress + type: IP Address + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - UPDATE - risk_score: UPDATE (impact * confidence)/100 + - _time + - body.properties.targetResources{}.userPrincipalName + - body.properties.initiatedBy.user.ipAddress + - body.properties.userAgent + risk_score: 54 security_domain: identity diff --git a/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml b/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml index 9314e3a0c9..035db6e554 100644 --- a/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml +++ b/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/azuread/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub update_timestamp: true From d99dd1ac7150531660167d8acec204dde6d552bb Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 15 Aug 2022 16:30:17 -0700 Subject: [PATCH 3/5] Update requirements.txt --- requirements.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/requirements.txt b/requirements.txt index db54162106..dae96ec7ae 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8,3 +8,6 @@ PyYAML questionary requests xmltodict +splunk-sdk +https://download.splunk.com/misc/packaging-toolkit/splunk-packaging-toolkit-1.0.1.tar.gz +splunk-appinspect From d00a4b2ae6f22d8d682b67d5d5e87f8a0ab46105 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 16 Aug 2022 12:13:00 -0400 Subject: [PATCH 4/5] updating detection yaml --- ...d_multi_factor_authentication_disabled.yml | 45 +++++++++++-------- ...ti_factor_authentication_disabled.test.yml | 2 +- 2 files changed, 28 insertions(+), 19 deletions(-) diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index 2860f82403..968808d394 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -5,17 +5,24 @@ date: '2022-08-10' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies an attempt to disable the MFA for a user. The attackers may disbale MFA after they acquire the credentials for the password. - This way the attackers can keep persistance in the environment without adding new users. Sometimes, the MFA may be disbaled by administrator for genuine purposes. -search: '`azuread` | spath "body.operationName" | search "body.operationName"="Disable Strong Authentication" - | rename body.properties.* as * | spath "body.properties.targetResources{}.userPrincipalName" | rename initiatedBy.user.ipAddress as ipAddress - | stats values(body.properties.targetResources{}.userPrincipalName) as userPrincipalName by _time, userAgent, ipAddress | `azure_ad_multi_factor_authentication_disabled_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents - log category. -known_false_positives: Legitimate users may disable MFA for debugging or testing. +description: The following analytic identifies an attempt to disable multi-factor authentication for an Azure AD user. An adversary who has obtained access to an Azure AD tenant + may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account. + This way the attackers can keep persistance in the environment without adding new users. +search: '`azuread` "body.operationName"="Disable Strong Authentication" + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename targetResources{}.type as type + | rename initiatedBy.user.userPrincipalName as initiatedBy + | stats values(userPrincipalName) by _time, type, body.operationName, initiatedBy, result + | `azure_ad_multi_factor_authentication_disabled_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. +Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed. references: - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +- https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates - https://attack.mitre.org/tactics/TA0005/ +- https://attack.mitre.org/techniques/T1556/ tags: analytic_story: - Azure Active Directory Account Takeover @@ -27,16 +34,17 @@ tags: confidence: 90 context: - Source:Cloud Data - - Stage:Initial Access + - Stage:Persistence + - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/azuread/azure-audit.log - impact: 60 + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/azuread/azure-audit.log + impact: 50 kill_chain_phases: - Installation - Actions on Objectives - message: MFA disabled for User $body.properties.targetResources{}.userPrincipalName$ + message: MFA disabled for User $userPrincipalName$ initiated by $initiatedBy$ mitre_attack_id: - - T1003.002 + - T1556 nist: - DE.CM observable: @@ -44,8 +52,8 @@ tags: type: User role: - Victim - - name: ipAddress - type: IP Address + - name: initiatedBy + type: User role: - Attacker product: @@ -55,7 +63,8 @@ tags: required_fields: - _time - body.properties.targetResources{}.userPrincipalName - - body.properties.initiatedBy.user.ipAddress - - body.properties.userAgent - risk_score: 54 + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 45 security_domain: identity diff --git a/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml b/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml index 035db6e554..f0ab83e5fb 100644 --- a/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml +++ b/tests/cloud/azure_ad_multi_factor_authentication_disabled.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: azure-audit.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/azuread/azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/azuread/azure-audit.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true From 393e7775f145ae82f9a60a7505006f71bae1f400 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 16 Aug 2022 12:19:07 -0400 Subject: [PATCH 5/5] fixing typo --- .../cloud/azure_ad_multi_factor_authentication_disabled.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index 968808d394..21b7bab24b 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -16,7 +16,7 @@ search: '`azuread` "body.operationName"="Disable Strong Authentication" | stats values(userPrincipalName) by _time, type, body.operationName, initiatedBy, result | `azure_ad_multi_factor_authentication_disabled_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. -Specifically, this analytic leverages the AuditLogs log category. + Specifically, this analytic leverages the AuditLogs log category. known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed. references: - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks