Branch was auto-updated.

detections/cloud/azure_active_directory_high_risk_sign_in.yml

@@ -0,0 +1,68 @@
+name: Azure Active Directory High Risk Sign-in
+id: 1ecff169-26d7-4161-9a7b-2ac4c8e61bea
+version: 1
+date: '2022-07-11'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic triggers on a high risk sign-in against Azure Active Directory identified by Azure Identity Protection. Identity Protection monitors sign-in events
+  using heuristics and machine learning to identify potentially malicious events and categorizes them in three categories high, medium and low.'
+search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high 
+  | rename body.properties.* as *
+  |  stats values(userPrincipalName) by _time, ipAddress, activity, riskLevel, riskEventType, additionalInfo
+  | `azure_active_directory_high_risk_sign_in_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents
+  log category.
+known_false_positives: Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
+- https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
+- https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$
+  mitre_attack_id:
+  - T1110
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.category
+  - body.properties.riskLevel
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.activity
+  - body.properties.riskEventType
+  - body.properties.additionalInfo
+  risk_score: 54
+  security_domain: identity

detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml

@@ -0,0 +1,69 @@
+name: Azure AD Authentication Failed During MFA Challenge
+id: e62c9c2e-bf51-4719-906c-3074618fcc1c
+version: 1
+date: '2022-07-14'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary
+  trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages,
+  and phone calls, potentially resulting in the user finally accepting the authentication request.'
+search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
+  | rename body.properties.* as *
+  | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent
+  | `azure_ad_authentication_failed_during_mfa_challenge_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents
+  log category.
+known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
+references:
+- https://attack.mitre.org/techniques/T1621/ 
+- https://attack.mitre.org/techniques/T1078/004/
+- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/azuread/azure-audit.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: User $body.properties.userPrincipalName$ failed to pass MFA challenge
+  mitre_attack_id:
+  - T1078
+  - T1078.004
+  - T1621
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.category
+  - body.properties.status.errorCode
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.status.additionalDetails
+  - body.properties.appDisplayName
+  - body.properties.userAgent
+  risk_score: 54
+  security_domain: identity

detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml

@@ -0,0 +1,72 @@
+name: Azure AD Multiple Users Failing To Authenticate From Ip
+id: 94481a6a-8f59-4c86-957f-55a71e3612a6
+version: 1
+date: '2022-07-12'
+author: Mauricio Velazco, Splunk
+type: Anomaly
+datamodel: []
+description: 'The following analytic identifies one source Ip failing to authenticate with 30 unique valid users within 5 minutes. This behavior could 
+  represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code
+  50126 represents an invalid password. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+  Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.'
+
+search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false 
+  | rename body.properties.* as *
+  | bucket span=5m _time
+  | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
+  | where unique_accounts > 30
+  | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
+- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
+- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users within 5 minutes.
+  mitre_attack_id:
+  - T1110
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.status.errorCode
+  - body.category
+  - body.properties.authenticationDetails
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  risk_score: 63
+  security_domain: identity

detections/cloud/azure_ad_successful_powershell_authentication.yml

@@ -0,0 +1,68 @@
+name: Azure AD Successful PowerShell Authentication
+id: 62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
+version: 1
+date: '2022-07-13'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. This behavior is not common for regular,
+ non administrative users. After compromising an account in Azure AD, attackers and red teams  alike will perform enumeration and discovery techniques. 
+ One method of executing these techniques is leveraging the native PowerShell modules.'
+search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true body.properties.appDisplayName="Azure Active Directory PowerShell"
+  | rename body.properties.* as *
+  |  stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent
+  | `azure_ad_successful_powershell_authentication_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1078/004/
+- https://docs.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0
+- https://securitycafe.ro/2022/04/29/pentesting-azure-recon-techniques/
+- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md 
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread_pws/azure-audit.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Successful authentication for user $body.properties.userPrincipalName$ using PowerShell.
+  mitre_attack_id:
+  - T1078
+  - T1078.004
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.appDisplayName
+  - body.category
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.appDisplayName
+  - body.properties.userAgent
+  risk_score: 54
+  security_domain: identity

detections/cloud/azure_ad_successful_single_factor_authentication.yml

@@ -0,0 +1,65 @@
+name: Azure AD Successful Single-Factor Authentication
+id: a560e7f6-1711-4353-885b-40be53101fcd
+version: 1
+date: '2022-07-12'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication 
+  enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated'
+search: ' `azuread`  body.category=SignInLogs body.properties.authenticationRequirement=singleFactorAuthentication body.properties.authenticationDetails{}.succeeded=true
+  | rename body.properties.* as *
+  |  stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement
+  | `azure_ad_successful_single_factor_authentication_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
+references:
+- https://attack.mitre.org/techniques/T1078/004/
+- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks*
+- https://www.forbes.com/sites/daveywinder/2020/07/08/new-dark-web-audit-reveals-15-billion-stolen-logins-from-100000-breaches-passwords-hackers-cybercrime/?sh=69927b2a180f
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread/azure-audit.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Successful authentication for user $body.properties.userPrincipalName$ without MFA
+  mitre_attack_id:
+  - T1003.002
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.category
+  - body.properties.authenticationRequirement
+  - body.properties.authenticationDetails
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.appDisplayName
+  risk_score: 50
+  security_domain: identity

detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml

@@ -0,0 +1,81 @@
+name: Azure AD Unusual Number of Failed Authentications From Ip
+id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d
+version: 1
+date: '2022-07-11'
+author: Mauricio Velazco, Splunk
+type: Anomaly
+datamodel: []
+description: 'The following analytic identifies one source Ip failing to authenticate with multiple valid users. This behavior could 
+  represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code
+  50126 represents an invalid password.\
+
+  The detection calculates the standard deviation for source Ip and leverages the
+  3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\
+
+  While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage.
+  A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.'
+
+search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false 
+  | rename body.properties.* as *
+  | bucket span=5m _time
+  | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
+  | eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by ipAddress
+  | eval  upperBound=(ip_avg+ip_std*3)
+  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+  | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
+- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
+- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$
+  mitre_attack_id:
+  - T1110
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.status.errorCode
+  - body.category
+  - body.properties.authenticationDetails
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  risk_score: 54
+  security_domain: access

macros/azuread.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=mscs:azure:eventhub
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: azuread

stories/azure_active_directory_account_takeover.yml

@@ -0,0 +1,34 @@
+name: Azure Active Directory Account Takeover
+id: 41514c46-7118-4eab-a9bb-f3bfa4e3bea9
+version: 2
+date: '2022-07-14'
+author: Mauricio Velazco, Splunk
+description: Monitor for activities and techniques associated with Account Takover
+  attacks against Azure Active Directory tenants.
+narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure
+  services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. 
+  According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\
+  Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, 
+  phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, 
+  or use any stolen information to access further accounts within the organization.\
+  This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.'
+references:
+- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis
+- https://azure.microsoft.com/en-us/services/active-directory/#overview
+- https://attack.mitre.org/techniques/T1586/
+- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad
+- https://www.imperva.com/learn/application-security/account-takeover-ato/
+- https://www.varonis.com/blog/azure-active-directory
+- https://www.barracuda.com/glossary/account-takeover
+tags:
+  analytic_story: Azure Active Directory Account Takeover
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Cloud Security
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/cloud/azure_active_directory_high_risk_sign_in.test.yml

@@ -0,0 +1,13 @@
+name: Azure Active Directory High Risk Sign-in Unit Test
+tests:
+- name: Azure Active Directory High Risk Sign-in
+  file: cloud/azure_active_directory_high_risk_sign_in.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azure-audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD Authentication Failed During MFA Challenge Unit Test
+tests:
+- name: Azure AD Authentication Failed During MFA Challenge
+  file: cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azure-audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/azuread/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

tests/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.test.yml

@@ -0,0 +1,14 @@
+name: Azure AD Multiple Users Failing To Authenticate From Ip Unit Test
+tests:
+- name: Azure AD Multiple Users Failing To Authenticate From Ip
+  file: cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azure-audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true
+

tests/cloud/azure_ad_successful_powershell_authentication.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD Successful PowerShell Authentication Unit Test
+tests:
+- name: Azure AD Successful PowerShell Authentication
+  file: cloud/azure_ad_successful_powershell_authentication.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azure-audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread_pws/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

tests/cloud/azure_ad_successful_single_factor_authentication.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD Successful Single-Factor Authentication Unit Test
+tests:
+- name: Azure AD Successful Single-Factor Authentication
+  file: cloud/azure_ad_successful_single_factor_authentication.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azure-audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD Unusual Number of Failed Authentications From Ip Unit Test
+tests:
+- name: Unusual Number of Failed Authentications From Ip
+  file: cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azure-audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true