From ca443d7b6ad3dd94d6f8465fd566514ec326a56b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 7 Jul 2022 18:06:58 -0400 Subject: [PATCH 01/22] adding analytic story and new macro --- macros/azure.yml | 4 ++ ...ure_active_directory_password_spraying.yml | 40 +++++++++++++++++++ 2 files changed, 44 insertions(+) create mode 100644 macros/azure.yml create mode 100644 stories/azure_active_directory_password_spraying.yml diff --git a/macros/azure.yml b/macros/azure.yml new file mode 100644 index 0000000000..0366aa641b --- /dev/null +++ b/macros/azure.yml @@ -0,0 +1,4 @@ +definition: eventtype=mscs:azure:eventhub +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: azure diff --git a/stories/azure_active_directory_password_spraying.yml b/stories/azure_active_directory_password_spraying.yml new file mode 100644 index 0000000000..245ccc5786 --- /dev/null +++ b/stories/azure_active_directory_password_spraying.yml @@ -0,0 +1,40 @@ +name: Azure Active Directory Password Spraying +id: 41514c46-7118-4eab-a9bb-f3bfa4e3bea9 +version: 1 +date: '2022-07-07' +author: Mauricio Velazco, Splunk +description: Monitor for activities and techniques associated with Password Spraying + attacks within Azure Active Directory tenants. +narrative: 'In a password spraying attack, adversaries leverage one or a small list + of commonly used / popular passwords against a large volume of usernames to acquire + valid account credentials. Unlike a Brute Force attack that targets a specific user + or small group of users with a large number of passwords, password spraying follows + the opposite aproach and increases the chances of obtaining valid credentials while + avoiding account lockouts. This allows adversaries to remain undetected if the target + organization does not have the proper monitoring and detection controls in place.\ + + Password Spraying can be leveraged by adversaries across different stages in an + attack. It can be used to obtain an iniial access to an environment but can also + be used to escalate privileges when access has been already achieved. In some scenarios, + this technique capitalizes on a security policy most organizations implement, password + rotation. As enterprise users change their passwords, it is possible some pick predictable, + seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\ + + Specifically, this Analytic Story is focused on detecting possible Password Spraying + attacks against Azure Active Directory tenants leveraging Azure AD Audit Logs.' +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray +- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a +tags: + analytic_story: Azure Active Directory Password Spraying + category: + - Adversary Tactics + - Account Compromise + - Cloud Security + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From ba163055ebf733e62964e8f80977f7845a0686ef Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 11 Jul 2022 17:29:18 -0400 Subject: [PATCH 02/22] adding 2 detections --- ...ure_active_directory_high_risk_sign_in.yml | 67 ++++++++++++++++++ ...mber_of_failed_authentications_from_ip.yml | 70 +++++++++++++++++++ macros/{azure.yml => azuread.yml} | 2 +- ...ure_active_directory_password_spraying.yml | 1 + ...ctive_directory_high_risk_sign_in.test.yml | 13 ++++ ...of_failed_authentications_from_ip.test.yml | 13 ++++ 6 files changed, 165 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_active_directory_high_risk_sign_in.yml create mode 100644 detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml rename macros/{azure.yml => azuread.yml} (93%) create mode 100644 tests/cloud/azure_active_directory_high_risk_sign_in.test.yml create mode 100644 tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml new file mode 100644 index 0000000000..357705b0fb --- /dev/null +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -0,0 +1,67 @@ +name: Azure Active Directory High Risk Sign-in +id: 1ecff169-26d7-4161-9a7b-2ac4c8e61bea +version: 1 +date: '2022-07-11' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic triggers on a high risk sign-in against Azure Active Directory identified by Azure Identity Protection. Identity Protection monitors sign-in events + using heuristics and machine learning to identify potentially malicious events and categorizes them in three categories high, medium and low.' +search: ' body.category=UserRiskEvents body.properties.riskLevel=high + | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.activity, body.properties.riskLevel, body.properties.riskEventType, body.properties.additionalInfo + | `azure_active_directory_high_risk_sign_in_filter`' +how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents + log category. +known_false_positives: Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray +- https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection +- https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks +tags: + analytic_story: + - Azure Active Directory Password Spraying + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit.log + impact: 60 + kill_chain_phases: + - Exploitation + message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$ + mitre_attack_id: + - T1110 + - T1110.003 + nist: + - DE.CM + observable: + - name: body.properties.userPrincipalName + type: User + role: + - Victim + - name: body.properties.ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.category + - body.properties.riskLevel + - body.properties.userPrincipalName + - body.properties.ipAddress + - body.properties.activity + - body.properties.riskEventType + - body.properties.additionalInfo + risk_score: 54 + security_domain: identity diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml new file mode 100644 index 0000000000..be0e0c7834 --- /dev/null +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -0,0 +1,70 @@ +name: Azure AD Unusual Number of Failed Authentications From Ip +id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d +version: 1 +date: '2022-07-11' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies one source Ip failing to authenticate with multiple valid users. This behavior could + represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code + 50126 represents an invalid password' +search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false + | bucket span=5m _time + | stats dc(body.properties.userPrincipalName) AS unique_accounts values(body.properties.userPrincipalName) as tried_accounts by _time, body.properties.ipAddress + | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by body.properties.ipAddress + | eval upperBound=(ip_avg+ip_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | `unusual_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray +- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a +- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes +tags: + analytic_story: + - Azure Active Directory Password Spraying + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log + impact: 60 + kill_chain_phases: + - Exploitation + message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$ + mitre_attack_id: + - T1110 + - T1110.003 + nist: + - DE.CM + observable: + - name: body.properties.userPrincipalName + type: User + role: + - Victim + - name: body.properties.ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.status.errorCode + - body.category + - body.properties.authenticationDetails + - body.properties.userPrincipalName + - body.properties.ipAddress + risk_score: 54 + security_domain: access diff --git a/macros/azure.yml b/macros/azuread.yml similarity index 93% rename from macros/azure.yml rename to macros/azuread.yml index 0366aa641b..0f00bbd5af 100644 --- a/macros/azure.yml +++ b/macros/azuread.yml @@ -1,4 +1,4 @@ definition: eventtype=mscs:azure:eventhub description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -name: azure +name: azuread diff --git a/stories/azure_active_directory_password_spraying.yml b/stories/azure_active_directory_password_spraying.yml index 245ccc5786..6d3693efb4 100644 --- a/stories/azure_active_directory_password_spraying.yml +++ b/stories/azure_active_directory_password_spraying.yml @@ -26,6 +26,7 @@ references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a +- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes tags: analytic_story: Azure Active Directory Password Spraying category: diff --git a/tests/cloud/azure_active_directory_high_risk_sign_in.test.yml b/tests/cloud/azure_active_directory_high_risk_sign_in.test.yml new file mode 100644 index 0000000000..be67e5f833 --- /dev/null +++ b/tests/cloud/azure_active_directory_high_risk_sign_in.test.yml @@ -0,0 +1,13 @@ +name: Azure Active Directory High Risk Sign-in Unit Test +tests: +- name: Azure Active Directory High Risk Sign-in + file: cloud/azure_active_directory_high_risk_sign_in.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit.log + source: UPDATE + sourcetype: UPDATE + update_timestamp: true diff --git a/tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml new file mode 100644 index 0000000000..004b4b87e1 --- /dev/null +++ b/tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Unusual Number of Failed Authentications Unit Test +tests: +- name: Unusual Number of Failed Authentications From Ip + file: cloud/azure_ad_unusual_number_of_failed_authentications.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log + source: UPDATE + sourcetype: mscs:azure:eventhub + update_timestamp: true From 45ee82ff9edb1b6bc4585d104ce6de865c93452f Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 12 Jul 2022 10:26:48 -0400 Subject: [PATCH 03/22] fixing macro --- detections/cloud/azure_active_directory_high_risk_sign_in.yml | 2 +- macros/azuread.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml index 357705b0fb..515b5c7e7d 100644 --- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -7,7 +7,7 @@ type: TTP datamodel: [] description: 'The following analytic triggers on a high risk sign-in against Azure Active Directory identified by Azure Identity Protection. Identity Protection monitors sign-in events using heuristics and machine learning to identify potentially malicious events and categorizes them in three categories high, medium and low.' -search: ' body.category=UserRiskEvents body.properties.riskLevel=high +search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.activity, body.properties.riskLevel, body.properties.riskEventType, body.properties.additionalInfo | `azure_active_directory_high_risk_sign_in_filter`' how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents diff --git a/macros/azuread.yml b/macros/azuread.yml index 0f00bbd5af..bff933179e 100644 --- a/macros/azuread.yml +++ b/macros/azuread.yml @@ -1,4 +1,4 @@ -definition: eventtype=mscs:azure:eventhub +definition: sourcetype=mscs:azure:eventhub description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: azuread From 743b94d8a9355a3c4bfbab1bdb9eeb5c4c306683 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 12 Jul 2022 11:22:38 -0400 Subject: [PATCH 04/22] updating test files --- .../cloud/azure_active_directory_high_risk_sign_in.test.yml | 4 ++-- ...nusual_number_of_failed_authentications_from_ip.test.yml | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/cloud/azure_active_directory_high_risk_sign_in.test.yml b/tests/cloud/azure_active_directory_high_risk_sign_in.test.yml index be67e5f833..d09971a7f9 100644 --- a/tests/cloud/azure_active_directory_high_risk_sign_in.test.yml +++ b/tests/cloud/azure_active_directory_high_risk_sign_in.test.yml @@ -8,6 +8,6 @@ tests: attack_data: - file_name: azure-audit.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit.log - source: UPDATE - sourcetype: UPDATE + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub update_timestamp: true diff --git a/tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml index 004b4b87e1..23ea84345e 100644 --- a/tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml +++ b/tests/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.test.yml @@ -1,13 +1,13 @@ -name: Azure AD Unusual Number of Failed Authentications Unit Test +name: Azure AD Unusual Number of Failed Authentications From Ip Unit Test tests: - name: Unusual Number of Failed Authentications From Ip - file: cloud/azure_ad_unusual_number_of_failed_authentications.yml + file: cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now attack_data: - file_name: azure-audit.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log - source: UPDATE + source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true From 797455e17f989b03ced7475c6681ceb047cdf775 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 12 Jul 2022 11:41:45 -0400 Subject: [PATCH 05/22] updating filter macro --- ...zure_ad_unusual_number_of_failed_authentications_from_ip.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index be0e0c7834..4d59450f19 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -14,7 +14,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by body.properties.ipAddress | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | `unusual_number_of_failed_authentications_from_ip_filter`' + | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. From f8e28dde20f719836d0cce5f0f7732031e2330d7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 12 Jul 2022 13:54:32 -0400 Subject: [PATCH 06/22] adding new detection --- ..._users_failing_to_authenticate_from_ip.yml | 71 +++++++++++++++++++ ...mber_of_failed_authentications_from_ip.yml | 12 +++- ...s_failing_to_authenticate_from_ip.test.yml | 14 ++++ 3 files changed, 96 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml create mode 100644 tests/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.test.yml diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml new file mode 100644 index 0000000000..d22e9ea6c5 --- /dev/null +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -0,0 +1,71 @@ +name: Azure AD Multiple Users Failing To Authenticate From Ip +id: 94481a6a-8f59-4c86-957f-55a71e3612a6 +version: 1 +date: '2022-07-12' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies one source Ip failing to authenticate with 30 unique valid users within 5 minutes. This behavior could + represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code + 50126 represents an invalid password. This logic can be used for real time security monitoring as well as threat hunting exercises.\ + + Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.' + +search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false +| bucket span=5m _time +| stats dc(body.properties.userPrincipalName) AS unique_accounts values(body.properties.userPrincipalName) as tried_accounts by _time, body.properties.ipAddress +| where unique_accounts > 30 +| `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' +how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. +references: +- https://attack.mitre.org/techniques/T1110/003/ +- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray +- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a +- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes +tags: + analytic_story: + - Azure Active Directory Password Spraying + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log + impact: 70 + kill_chain_phases: + - Exploitation + message: UPDATE message + mitre_attack_id: + - T1110 + - T1110.003 + nist: + - DE.CM + observable: + - name: body.properties.userPrincipalName + type: User + role: + - Victim + - name: body.properties.ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.status.errorCode + - body.category + - body.properties.authenticationDetails + - body.properties.userPrincipalName + - body.properties.ipAddress + risk_score: 63 + security_domain: identity diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 4d59450f19..b78c1ce783 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -7,7 +7,17 @@ type: Anomaly datamodel: [] description: 'The following analytic identifies one source Ip failing to authenticate with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code - 50126 represents an invalid password' + 50126 represents an invalid password.\ + + The detection calculates the standard deviation for source Ip and leverages the + 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this + analytic, users can try different combinations of the `bucket` span time and the + calculation of the `upperBound` field. This logic can be used for real time security + monitoring as well as threat hunting exercises.\ + + While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. + A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.' + search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false | bucket span=5m _time | stats dc(body.properties.userPrincipalName) AS unique_accounts values(body.properties.userPrincipalName) as tried_accounts by _time, body.properties.ipAddress diff --git a/tests/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.test.yml b/tests/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.test.yml new file mode 100644 index 0000000000..3f29151129 --- /dev/null +++ b/tests/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.test.yml @@ -0,0 +1,14 @@ +name: Azure AD Multiple Users Failing To Authenticate From Ip Unit Test +tests: +- name: Azure AD Multiple Users Failing To Authenticate From Ip + file: cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true + From 18aa9f2e7aa9940f5099003ecb31fc871f582376 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 12 Jul 2022 18:03:26 -0400 Subject: [PATCH 07/22] adding new detection --- ..._users_failing_to_authenticate_from_ip.yml | 2 +- ...uccessful_single_factor_authentication.yml | 64 +++++++++++++++++++ ...sful_single_factor_authentication.test.yml | 13 ++++ 3 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_ad_successful_single_factor_authentication.yml create mode 100644 tests/cloud/azure_ad_successful_single_factor_authentication.test.yml diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index d22e9ea6c5..a4b82ab84d 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -41,7 +41,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: UPDATE message + message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users within 5 minutes. mitre_attack_id: - T1110 - T1110.003 diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml new file mode 100644 index 0000000000..88851964a6 --- /dev/null +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -0,0 +1,64 @@ +name: Azure AD Successful Single-Factor Authentication +id: a560e7f6-1711-4353-885b-40be53101fcd +version: 1 +date: '2022-07-12' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication + enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated' +search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequirement=singleFactorAuthentication body.properties.authenticationDetails{}.succeeded=true + | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.appDisplayName, body.properties.authenticationRequirement + | `azure_ad_successful_single_factor_authentication_filter`' +how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed +references: +- https://attack.mitre.org/techniques/T1078/004/ +- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks* +- https://www.forbes.com/sites/daveywinder/2020/07/08/new-dark-web-audit-reveals-15-billion-stolen-logins-from-100000-breaches-passwords-hackers-cybercrime/?sh=69927b2a180f +tags: + analytic_story: + - Azure Active Directory Password Spraying + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread/azure-audit.log + impact: 50 + kill_chain_phases: + - Exploitation + message: Successful authentication for user $body.properties.userPrincipalName$ without MFA + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: body.properties.userPrincipalName + type: User + role: + - Victim + - name: body.properties.ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.category + - body.properties.authenticationRequirement + - body.properties.authenticationDetails + - body.properties.userPrincipalName + - body.properties.ipAddress + - body.properties.appDisplayName + risk_score: 50 + security_domain: identity diff --git a/tests/cloud/azure_ad_successful_single_factor_authentication.test.yml b/tests/cloud/azure_ad_successful_single_factor_authentication.test.yml new file mode 100644 index 0000000000..96e71e9218 --- /dev/null +++ b/tests/cloud/azure_ad_successful_single_factor_authentication.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Successful Single-Factor Authentication Unit Test +tests: +- name: Azure AD Successful Single-Factor Authentication + file: cloud/azure_ad_successful_single_factor_authentication.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 7807c66f7309240359a0315cd16d2f2e43717fdf Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 13 Jul 2022 14:16:09 -0400 Subject: [PATCH 08/22] adding new detection --- ...d_successful_powershell_authentication.yml | 63 +++++++++++++++++++ ...cessful_powershell_authentication.test.yml | 13 ++++ 2 files changed, 76 insertions(+) create mode 100644 detections/cloud/azure_ad_successful_powershell_authentication.yml create mode 100644 tests/cloud/azure_ad_successful_powershell_authentication.test.yml diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml new file mode 100644 index 0000000000..74de6ce797 --- /dev/null +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -0,0 +1,63 @@ +name: Azure AD Successful PowerShell Authentication +id: 62f10052-d7b3-4e48-b57b-56f8e3ac7ceb +version: 1 +date: '2022-07-13' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies a ' +search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true body.properties.appDisplayName="Azure Active Directory PowerShell" + | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.appDisplayName, body.properties.userAgent + | `azure_ad_successful_powershell_authentication_filter`' +how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1078/004/ +- https://docs.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0 +tags: + analytic_story: + - Azure Active Directory Password Spraying + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread_pws/azure-audit.log + impact: 60 + kill_chain_phases: + - Exploitation + message: Successful authentication for user $body.properties.userPrincipalName$ using PowerShell. + mitre_attack_id: + - T1078 + - T1078.004 + nist: + - DE.CM + observable: + - name: body.properties.userPrincipalName + type: User + role: + - Victim + - name: body.properties.ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.appDisplayName + - body.category + - body.properties.userPrincipalName + - body.properties.ipAddress + - body.properties.appDisplayName + - body.properties.userAgent + risk_score: 53 + security_domain: identity diff --git a/tests/cloud/azure_ad_successful_powershell_authentication.test.yml b/tests/cloud/azure_ad_successful_powershell_authentication.test.yml new file mode 100644 index 0000000000..3cf7e512d8 --- /dev/null +++ b/tests/cloud/azure_ad_successful_powershell_authentication.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Successful PowerShell Authentication Unit Test +tests: +- name: Azure AD Successful PowerShell Authentication + file: endpoint/azure_ad_successful_powershell_authentication.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread_pws/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From f6666320175dec57c3b735b8ecc27c2f36b8d226 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 13 Jul 2022 14:23:38 -0400 Subject: [PATCH 09/22] update description --- .../azure_ad_successful_powershell_authentication.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index 74de6ce797..0e37ef39d9 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -5,7 +5,8 @@ date: '2022-07-13' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: 'The following analytic identifies a ' +description: 'The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. After compromising an account in Azure AD, attackers and red teams + alike will perform enumeration and discovery techniques. One method of executing these techniques is leveraging the native PowerShell modules. ' search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true body.properties.appDisplayName="Azure Active Directory PowerShell" | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.appDisplayName, body.properties.userAgent | `azure_ad_successful_powershell_authentication_filter`' @@ -15,6 +16,8 @@ known_false_positives: Administrative users will likely use PowerShell commandle references: - https://attack.mitre.org/techniques/T1078/004/ - https://docs.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0 +- https://securitycafe.ro/2022/04/29/pentesting-azure-recon-techniques/ +- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md tags: analytic_story: - Azure Active Directory Password Spraying @@ -59,5 +62,5 @@ tags: - body.properties.ipAddress - body.properties.appDisplayName - body.properties.userAgent - risk_score: 53 + risk_score: 54 security_domain: identity From b6157289244207069705963ee330f2e7ffefaf21 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 13 Jul 2022 14:38:13 -0400 Subject: [PATCH 10/22] fixing file path --- .../cloud/azure_ad_successful_powershell_authentication.yml | 5 +++-- .../azure_ad_successful_powershell_authentication.test.yml | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index 0e37ef39d9..f573d7f93f 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -5,8 +5,9 @@ date: '2022-07-13' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: 'The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. After compromising an account in Azure AD, attackers and red teams - alike will perform enumeration and discovery techniques. One method of executing these techniques is leveraging the native PowerShell modules. ' +description: 'The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. This behavior is not common for regular, + non administrative users. After compromising an account in Azure AD, attackers and red teams alike will perform enumeration and discovery techniques. + One method of executing these techniques is leveraging the native PowerShell modules.' search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true body.properties.appDisplayName="Azure Active Directory PowerShell" | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.appDisplayName, body.properties.userAgent | `azure_ad_successful_powershell_authentication_filter`' diff --git a/tests/cloud/azure_ad_successful_powershell_authentication.test.yml b/tests/cloud/azure_ad_successful_powershell_authentication.test.yml index 3cf7e512d8..3a23ae5820 100644 --- a/tests/cloud/azure_ad_successful_powershell_authentication.test.yml +++ b/tests/cloud/azure_ad_successful_powershell_authentication.test.yml @@ -1,7 +1,7 @@ name: Azure AD Successful PowerShell Authentication Unit Test tests: - name: Azure AD Successful PowerShell Authentication - file: endpoint/azure_ad_successful_powershell_authentication.yml + file: cloud/azure_ad_successful_powershell_authentication.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From d6dd5098bee3ae00a0e3fdea5c93e9528b2442e8 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 14 Jul 2022 13:29:55 -0400 Subject: [PATCH 11/22] adding new detection --- ...entication_failed_during_mfa_challenge.yml | 68 +++++++++++++++++++ ...ation_failed_during_mfa_challenge.test.yml | 13 ++++ 2 files changed, 81 insertions(+) create mode 100644 detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml create mode 100644 tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml new file mode 100644 index 0000000000..e98e632057 --- /dev/null +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -0,0 +1,68 @@ +name: Azure AD Authentication Failed During MFA Challenge +id: e62c9c2e-bf51-4719-906c-3074618fcc1c +version: 1 +date: '2022-07-14' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary + trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, + and phone calls, potentially resulting in the user finally accepting the authentication request.' +search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 + | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.status.additionalDetails, body.properties.appDisplayName, body.properties.userAgent + | `azure_ad_authentication_failed_during_mfa_challenge_filter`' +how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents + log category. +known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. +references: +- https://attack.mitre.org/techniques/T1621/ +- https://attack.mitre.org/techniques/T1078/004/ +- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +tags: + analytic_story: + - Azure Active Directory Password Spraying + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/azuread/azure-audit.log + impact: 60 + kill_chain_phases: + - Exploitation + message: User $body.properties.userPrincipalName$ failed to pass MFA challenge + mitre_attack_id: + - T1078 + - T1078.004 + - T1621 + nist: + - DE.CM + observable: + - name: body.properties.userPrincipalName + type: User + role: + - Victim + - name: body.properties.ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.category + - body.properties.status.errorCode + - body.properties.userPrincipalName + - body.properties.ipAddress + - body.properties.status.additionalDetails + - body.properties.appDisplayName + - body.properties.userAgent + risk_score: 54 + security_domain: identity diff --git a/tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml b/tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml new file mode 100644 index 0000000000..eca12c0ab3 --- /dev/null +++ b/tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Authentication Failed During MFA Challenge Unit Test +tests: +- name: Azure AD Authentication Failed During MFA Challenge + file: cloud/azure_ad_authentication_failed_during_mfa_challenge.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/azuread/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From fee335e73d809ac5ca49e5e0c1c58b52db8b8fb0 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 14 Jul 2022 16:44:33 -0400 Subject: [PATCH 12/22] renaming analytic story --- ...ure_active_directory_high_risk_sign_in.yml | 2 +- ...entication_failed_during_mfa_challenge.yml | 2 +- ..._users_failing_to_authenticate_from_ip.yml | 2 +- ...d_successful_powershell_authentication.yml | 2 +- ...uccessful_single_factor_authentication.yml | 2 +- ...mber_of_failed_authentications_from_ip.yml | 2 +- ...zure_active_directory_account_takeover.yml | 36 ++++++++++++++++ ...ure_active_directory_password_spraying.yml | 41 ------------------- 8 files changed, 42 insertions(+), 47 deletions(-) create mode 100644 stories/azure_active_directory_account_takeover.yml delete mode 100644 stories/azure_active_directory_password_spraying.yml diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml index 515b5c7e7d..342020765b 100644 --- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -20,7 +20,7 @@ references: - https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks tags: analytic_story: - - Azure Active Directory Password Spraying + - Azure Active Directory Account Takeover asset_type: Azure Active Directory cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index e98e632057..cbcaae87d2 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -20,7 +20,7 @@ references: - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks tags: analytic_story: - - Azure Active Directory Password Spraying + - Azure Active Directory Account Takeover asset_type: Azure Active Directory cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index a4b82ab84d..39f59f9cd9 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -26,7 +26,7 @@ references: - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes tags: analytic_story: - - Azure Active Directory Password Spraying + - Azure Active Directory Account Takeover asset_type: Azure Active Directory cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index f573d7f93f..385cede41c 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -21,7 +21,7 @@ references: - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md tags: analytic_story: - - Azure Active Directory Password Spraying + - Azure Active Directory Account Takeover asset_type: Azure Active Directory cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index 88851964a6..7487820842 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -19,7 +19,7 @@ references: - https://www.forbes.com/sites/daveywinder/2020/07/08/new-dark-web-audit-reveals-15-billion-stolen-logins-from-100000-breaches-passwords-hackers-cybercrime/?sh=69927b2a180f tags: analytic_story: - - Azure Active Directory Password Spraying + - Azure Active Directory Account Takeover asset_type: Azure Active Directory cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index b78c1ce783..998a42521f 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -35,7 +35,7 @@ references: - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes tags: analytic_story: - - Azure Active Directory Password Spraying + - Azure Active Directory Account Takeover asset_type: Azure Active Directory cis20: - CIS 3 diff --git a/stories/azure_active_directory_account_takeover.yml b/stories/azure_active_directory_account_takeover.yml new file mode 100644 index 0000000000..dc0acff37e --- /dev/null +++ b/stories/azure_active_directory_account_takeover.yml @@ -0,0 +1,36 @@ +name: Azure Active Directory Account Takeover +id: 41514c46-7118-4eab-a9bb-f3bfa4e3bea9 +version: 2 +date: '2022-07-14' +author: Mauricio Velazco, Splunk +description: Monitor for activities and techniques associated with Account Takover + attacks against Azure Active Directory tenants. +narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure + services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. + According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ + + Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, + phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, + or use any stolen information to access further accounts within the organization\. + + This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.' +references: +- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis +- https://azure.microsoft.com/en-us/services/active-directory/#overview +- https://attack.mitre.org/techniques/T1586/ +- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad +- https://www.imperva.com/learn/application-security/account-takeover-ato/ +- https://www.varonis.com/blog/azure-active-directory +- https://www.barracuda.com/glossary/account-takeover +tags: + analytic_story: Azure Active Directory Account Takeover + category: + - Adversary Tactics + - Account Compromise + - Cloud Security + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/azure_active_directory_password_spraying.yml b/stories/azure_active_directory_password_spraying.yml deleted file mode 100644 index 6d3693efb4..0000000000 --- a/stories/azure_active_directory_password_spraying.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: Azure Active Directory Password Spraying -id: 41514c46-7118-4eab-a9bb-f3bfa4e3bea9 -version: 1 -date: '2022-07-07' -author: Mauricio Velazco, Splunk -description: Monitor for activities and techniques associated with Password Spraying - attacks within Azure Active Directory tenants. -narrative: 'In a password spraying attack, adversaries leverage one or a small list - of commonly used / popular passwords against a large volume of usernames to acquire - valid account credentials. Unlike a Brute Force attack that targets a specific user - or small group of users with a large number of passwords, password spraying follows - the opposite aproach and increases the chances of obtaining valid credentials while - avoiding account lockouts. This allows adversaries to remain undetected if the target - organization does not have the proper monitoring and detection controls in place.\ - - Password Spraying can be leveraged by adversaries across different stages in an - attack. It can be used to obtain an iniial access to an environment but can also - be used to escalate privileges when access has been already achieved. In some scenarios, - this technique capitalizes on a security policy most organizations implement, password - rotation. As enterprise users change their passwords, it is possible some pick predictable, - seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\ - - Specifically, this Analytic Story is focused on detecting possible Password Spraying - attacks against Azure Active Directory tenants leveraging Azure AD Audit Logs.' -references: -- https://attack.mitre.org/techniques/T1110/003/ -- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray -- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a -- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes -tags: - analytic_story: Azure Active Directory Password Spraying - category: - - Adversary Tactics - - Account Compromise - - Cloud Security - - Privilege Escalation - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - usecase: Advanced Threat Detection From 0fa185eeabf48ba3ce2fe87e411ba9c91374632e Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 14 Jul 2022 16:55:46 -0400 Subject: [PATCH 13/22] updating description --- stories/azure_active_directory_account_takeover.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/stories/azure_active_directory_account_takeover.yml b/stories/azure_active_directory_account_takeover.yml index dc0acff37e..2b0eb22820 100644 --- a/stories/azure_active_directory_account_takeover.yml +++ b/stories/azure_active_directory_account_takeover.yml @@ -8,11 +8,9 @@ description: Monitor for activities and techniques associated with Account Takov narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ - Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, - or use any stolen information to access further accounts within the organization\. - + or use any stolen information to access further accounts within the organization.\ This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.' references: - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis From c9b348b06fd79cc5094c09afc3940c26947b0a30 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 19 Jul 2022 08:50:07 -0600 Subject: [PATCH 14/22] Added rename --- .../cloud/azure_active_directory_high_risk_sign_in.yml | 3 ++- ...ure_ad_authentication_failed_during_mfa_challenge.yml | 3 ++- ...ad_multiple_users_failing_to_authenticate_from_ip.yml | 9 +++++---- .../azure_ad_successful_powershell_authentication.yml | 5 +++-- .../azure_ad_successful_single_factor_authentication.yml | 5 +++-- ..._unusual_number_of_failed_authentications_from_ip.yml | 5 +++-- 6 files changed, 18 insertions(+), 12 deletions(-) diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml index 342020765b..01c95aa1c1 100644 --- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -8,7 +8,8 @@ datamodel: [] description: 'The following analytic triggers on a high risk sign-in against Azure Active Directory identified by Azure Identity Protection. Identity Protection monitors sign-in events using heuristics and machine learning to identify potentially malicious events and categorizes them in three categories high, medium and low.' search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high - | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.activity, body.properties.riskLevel, body.properties.riskEventType, body.properties.additionalInfo + | rename body.properties.* as * + | stats values(userPrincipalName) by _time, ipAddress, activity, riskLevel, riskEventType, additionalInfo | `azure_active_directory_high_risk_sign_in_filter`' how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category. diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index cbcaae87d2..f96ed3a1f5 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -9,7 +9,8 @@ description: 'The following analytic identifies an authentication attempt event trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request.' search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 - | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.status.additionalDetails, body.properties.appDisplayName, body.properties.userAgent + | rename body.properties.* as * + | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`' how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category. diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 39f59f9cd9..0c2513f385 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -12,10 +12,11 @@ description: 'The following analytic identifies one source Ip failing to authent Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.' search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false -| bucket span=5m _time -| stats dc(body.properties.userPrincipalName) AS unique_accounts values(body.properties.userPrincipalName) as tried_accounts by _time, body.properties.ipAddress -| where unique_accounts > 30 -| `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' + | rename body.properties.* as * + | bucket span=5m _time + | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress + | where unique_accounts > 30 + | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index 385cede41c..95780b1703 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -8,8 +8,9 @@ datamodel: [] description: 'The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. This behavior is not common for regular, non administrative users. After compromising an account in Azure AD, attackers and red teams alike will perform enumeration and discovery techniques. One method of executing these techniques is leveraging the native PowerShell modules.' -search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true body.properties.appDisplayName="Azure Active Directory PowerShell" - | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.appDisplayName, body.properties.userAgent +search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true body.properties.appDisplayName="Azure Active Directory PowerShell" + | rename body.properties.* as * + | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent | `azure_ad_successful_powershell_authentication_filter`' how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index 7487820842..2da8b39439 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -7,8 +7,9 @@ type: TTP datamodel: [] description: 'The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated' -search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequirement=singleFactorAuthentication body.properties.authenticationDetails{}.succeeded=true - | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.appDisplayName, body.properties.authenticationRequirement +search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequirement=singleFactorAuthentication body.properties.authenticationDetails{}.succeeded=true + | rename body.properties.* as * + | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement | `azure_ad_successful_single_factor_authentication_filter`' how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 998a42521f..27f2391de5 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -19,9 +19,10 @@ description: 'The following analytic identifies one source Ip failing to authent A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.' search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false + | rename body.properties.* as * | bucket span=5m _time - | stats dc(body.properties.userPrincipalName) AS unique_accounts values(body.properties.userPrincipalName) as tried_accounts by _time, body.properties.ipAddress - | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by body.properties.ipAddress + | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress + | eventstats avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by ipAddress | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' From f22813da22a044519e0023c73337b40f05ccb31c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Jul 2022 14:05:14 -0700 Subject: [PATCH 15/22] Update azure_active_directory_high_risk_sign_in.yml --- .../cloud/azure_active_directory_high_risk_sign_in.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml index 01c95aa1c1..c954b432e5 100644 --- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -11,7 +11,7 @@ search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, activity, riskLevel, riskEventType, additionalInfo | `azure_active_directory_high_risk_sign_in_filter`' -how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category. known_false_positives: Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives. references: @@ -43,11 +43,11 @@ tags: nist: - DE.CM observable: - - name: body.properties.userPrincipalName + - name: userPrincipalName type: User role: - Victim - - name: body.properties.ipAddress + - name: ipAddress type: IP Address role: - Attacker From 72d0a37a125f4a2cd224df2f7170c05ac3011bec Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Jul 2022 14:05:57 -0700 Subject: [PATCH 16/22] Update azure_ad_authentication_failed_during_mfa_challenge.yml --- .../azure_ad_authentication_failed_during_mfa_challenge.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index f96ed3a1f5..16eb8e8103 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -12,7 +12,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50 | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`' -how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category. known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. references: @@ -44,11 +44,11 @@ tags: nist: - DE.CM observable: - - name: body.properties.userPrincipalName + - name: userPrincipalName type: User role: - Victim - - name: body.properties.ipAddress + - name: ipAddress type: IP Address role: - Attacker From 42241b1b2e6f6b32ae109de84698026b54b9e301 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Jul 2022 14:07:47 -0700 Subject: [PATCH 17/22] Update azure_ad_multiple_users_failing_to_authenticate_from_ip.yml --- ...re_ad_multiple_users_failing_to_authenticate_from_ip.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 0c2513f385..60c226d134 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -17,7 +17,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' -how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: @@ -49,11 +49,11 @@ tags: nist: - DE.CM observable: - - name: body.properties.userPrincipalName + - name: userPrincipalName type: User role: - Victim - - name: body.properties.ipAddress + - name: ipAddress type: IP Address role: - Attacker From 07290ffeb7ee909dda45c88e6dc56340377a11be Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Jul 2022 14:08:32 -0700 Subject: [PATCH 18/22] Update azure_ad_successful_powershell_authentication.yml --- .../cloud/azure_ad_successful_powershell_authentication.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index 95780b1703..2065f5068f 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -12,7 +12,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetai | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent | `azure_ad_successful_powershell_authentication_filter`' -how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed. references: @@ -44,11 +44,11 @@ tags: nist: - DE.CM observable: - - name: body.properties.userPrincipalName + - name: userPrincipalName type: User role: - Victim - - name: body.properties.ipAddress + - name: ipAddress type: IP Address role: - Attacker From 22f3d9bfeee07a1200e5ae682e734bf76e2fef1d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Jul 2022 14:09:17 -0700 Subject: [PATCH 19/22] Update azure_ad_successful_powershell_authentication.yml From 95e47b7fd4066518793156c9bd55383c70328959 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Jul 2022 14:11:40 -0700 Subject: [PATCH 20/22] Update azure_ad_unusual_number_of_failed_authentications_from_ip.yml --- ..._ad_unusual_number_of_failed_authentications_from_ip.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 27f2391de5..b7041a57d4 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -26,7 +26,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' -how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement:You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: @@ -58,11 +58,11 @@ tags: nist: - DE.CM observable: - - name: body.properties.userPrincipalName + - name: userPrincipalName type: User role: - Victim - - name: body.properties.ipAddress + - name: ipAddress type: IP Address role: - Attacker From 1b645a499ca098bd280caf16f6a14ee720bfc46e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 28 Jul 2022 14:12:18 -0700 Subject: [PATCH 21/22] Update azure_ad_successful_single_factor_authentication.yml --- .../azure_ad_successful_single_factor_authentication.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index 2da8b39439..6753b53694 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -11,7 +11,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequ | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement | `azure_ad_successful_single_factor_authentication_filter`' -how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed references: @@ -41,11 +41,11 @@ tags: nist: - DE.CM observable: - - name: body.properties.userPrincipalName + - name: userPrincipalName type: User role: - Victim - - name: body.properties.ipAddress + - name: ipAddress type: IP Address role: - Attacker From 114df09d78b81f2bc71c0b62000fe42fab62ae60 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 28 Jul 2022 14:18:45 -0700 Subject: [PATCH 22/22] meta updates --- detections/cloud/azure_active_directory_high_risk_sign_in.yml | 2 +- .../azure_ad_authentication_failed_during_mfa_challenge.yml | 2 +- .../azure_ad_multiple_users_failing_to_authenticate_from_ip.yml | 2 +- .../cloud/azure_ad_successful_powershell_authentication.yml | 2 +- .../cloud/azure_ad_successful_single_factor_authentication.yml | 2 +- ...zure_ad_unusual_number_of_failed_authentications_from_ip.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml index c954b432e5..b31b4d3f11 100644 --- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -11,7 +11,7 @@ search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, activity, riskLevel, riskEventType, additionalInfo | `azure_active_directory_high_risk_sign_in_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category. known_false_positives: Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives. references: diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index 16eb8e8103..e53f414612 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -12,7 +12,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50 | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category. known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. references: diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 60c226d134..01d0c876ed 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -17,7 +17,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index 2065f5068f..c67bf0500c 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -12,7 +12,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetai | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent | `azure_ad_successful_powershell_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed. references: diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index 6753b53694..e86cbcc422 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -11,7 +11,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequ | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement | `azure_ad_successful_single_factor_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed references: diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index b7041a57d4..dabd3a2a14 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -26,7 +26,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' -how_to_implement:You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(ref: https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: