admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-09-15 09:15:58 -07:00
committed by GitHub
parent 710e6aab5e 8e7a546d70
commit 335213620c
35 changed files with 1173 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
+1 -1
View File
@@ -11,7 +11,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50
| rename body.properties.* as *
| stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent
| `azure_ad_authentication_failed_during_mfa_challenge_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
log category.
known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
references:
detections/cloud/azure_ad_external_guest_user_invited.yml
+70
View File
@@ -0,0 +1,70 @@
name: Azure AD External Guest User Invited
id: c1fb4edb-cab1-4359-9b40-925ffd797fb5
version: 1
date: '2022-08-18'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: 'The following analytic identifies the invitation of an external guest user within Azure AD.
With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users.
External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access.
An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External
Identities`'
search: '`azuread` "body.operationName"="Invite external user"
| rename body.properties.* as *
| rename targetResources{}.userPrincipalName as userPrincipalName
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename targetResources{}.type as type
| stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName
| `azure_ad_external_guest_user_invited_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: Administrator may legitimately invite external guest users. Filter as needed.
references:
- https://dirkjanm.io/assets/raw/US-22-Mollema-Backdooring-and-hijacking-Azure-AD-accounts_final.pdf
- https://www.blackhat.com/us-22/briefings/schedule/#backdooring-and-hijacking-azure-ad-accounts-by-abusing-external-identities-26999
- https://attack.mitre.org/techniques/T1136/003/
- https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit.log
impact: 50
kill_chain_phases:
- Exploitation
message: External Guest User $userPrincipalName$ initiated by $initiatedBy$
mitre_attack_id:
- T1136.003
nist:
- DE.CM
observable:
- name: userPrincipalName
type: User
role:
- Victim
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.properties.targetResources{}.userPrincipalName
- body.properties.targetResources{}.type
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.result
risk_score: 45
security_domain: threat
detections/cloud/azure_ad_global_administrator_role_assigned.yml
+70
View File
@@ -0,0 +1,70 @@
name: Azure AD Global Administrator Role Assigned
id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
version: 1
date: '2022-08-17'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user.
The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment.
While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources.
Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
search: '`azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global Administrator\""
| rename body.properties.* as *
| rename targetResources{}.userPrincipalName as userPrincipalName
| rename initiatedBy.user.userPrincipalName as initiatedBy
| stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
| `azure_ad_global_administrator_role_assigned_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
references:
- https://o365blog.com/post/admin/
- https://adsecurity.org/?p=4277
- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
- https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning
- https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
- https://attack.mitre.org/techniques/T1098/003/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit.log
impact: 80
kill_chain_phases:
- Exploitation
message: Global Administrator Role assigned for User $userPrincipalName$ initiated by $initiatedBy$
mitre_attack_id:
- T1098.003
nist:
- DE.CM
observable:
- name: userPrincipalName
type: User
role:
- Victim
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.properties.targetResources{}.userPrincipalName
- body.properties.targetResources{}.type
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.result
risk_score: 72
security_domain: threat
detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
+2 -1
View File
@@ -17,7 +17,8 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI
| stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
| where unique_accounts > 30
| `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs.
log category.
known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
references:
detections/cloud/azure_ad_new_custom_domain_added.yml
+73
View File
@@ -0,0 +1,73 @@
name: Azure AD New Custom Domain Added
id: 30c47f45-dd6a-4720-9963-0bca6c8686ef
version: 1
date: '2022-09-02'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain
is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa.
Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a
single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for
email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication,
the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique
to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
search: ' `azuread` body.operationName="Add unverified domain" "body.properties.result"=success
| rename body.properties.* as *
| rename body.callerIpAddress as callerIpAddress
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename targetResources{}.displayName as domain
| stats values(domain) by _time, initiatedBy, result, body.operationName, callerIpAddress
| `azure_ad_new_custom_domain_added_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: In most organizations, new customm domains will be updated infrequently. Filter as needed.
references:
- https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-manage
- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13
- https://o365blog.com/post/federation-vulnerability/
- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html
- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
- https://attack.mitre.org/techniques/T1484/002/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log
impact: 60
kill_chain_phases:
- Installation
- Actions on Objectives
message: A new custom domain, $domain$ , was added by $initiatedBy$
mitre_attack_id:
- T1484
- T1484.002
nist:
- DE.CM
observable:
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.operationName
- body.properties.result
- body.callerIpAddress
- body.properties.targetResources{}.displayName
- body.properties.initiatedBy.user.userPrincipalName
risk_score: 54
security_domain: threat
detections/cloud/azure_ad_new_federated_domain_added.yml
+72
View File
@@ -0,0 +1,72 @@
name: Azure AD New Federated Domain Added
id: a87cd633-076d-4ab2-9047-977751a3c1a0
version: 1
date: '2022-09-02'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution
of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa.
Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a
single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for
email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication,
the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique
to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
search: ' `azuread` body.operationName="Set domain authentication" "body.properties.result"=success
| rename body.properties.* as *
| rename body.callerIpAddress as callerIpAddress
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename targetResources{}.displayName as domain
| stats values(domain) by _time, initiatedBy, result, body.operationName, callerIpAddress
| `azure_ad_new_federated_domain_added_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: In most organizations, domain federation settings will be updated infrequently. Filter as needed.
references:
- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13
- https://o365blog.com/post/federation-vulnerability/
- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html
- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
- https://attack.mitre.org/techniques/T1484/002/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log
impact: 90
kill_chain_phases:
- Installation
- Actions on Objectives
message: A new federated domain, $domain$ , was added by $initiatedBy$
mitre_attack_id:
- T1484
- T1484.002
nist:
- DE.CM
observable:
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.operationName
- body.properties.result
- body.callerIpAddress
- body.properties.targetResources{}.displayName
- body.properties.initiatedBy.user.userPrincipalName
risk_score: 81
security_domain: threat
detections/cloud/azure_ad_privileged_role_assigned.yml
+72
View File
@@ -0,0 +1,72 @@
name: Azure AD Privileged Role Assigned
id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a
version: 1
date: '2022-08-29'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user.
Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment.
search: ' `azuread` "body.operationName"="Add member to role"
| rename body.properties.* as *
| rename targetResources{}.userPrincipalName as userPrincipalName
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename targetResources{}.modifiedProperties{}.newValue as roles
| eval role=mvindex(roles,1)
| lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True
| stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description
| `azure_ad_privileged_role_assigned_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed.
references:
- https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roles
- https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
- https://adsecurity.org/?p=4277
- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
- https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning
- https://attack.mitre.org/techniques/T1098/003/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log
impact: 70
kill_chain_phases:
- Installation
message: A privileged Azure AD role was assigned for User $userPrincipalName$ initiated by $initiatedBy$
mitre_attack_id:
- T1098
- T1098.003
nist:
- DE.CM
observable:
- name: userPrincipalName
type: User
role:
- Victim
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.properties.targetResources{}.userPrincipalName
- body.properties.targetResources{}.type
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.result
risk_score: 63
security_domain: audit
detections/cloud/azure_ad_service_principal_created.yml
+70
View File
@@ -0,0 +1,70 @@
name: Azure AD Service Principal Created
id: f8ba49e7-ffd3-4b53-8f61-e73974583c5d
version: 1
date: '2022-08-17'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the creation of a Service Principal in an Azure AD environment.
An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment.
Service Principal authentication does not support multi-factor authentication nor conditional access policies.
Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=*
| rename body.properties.* as *
| rename targetResources{}.displayName as displayName
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename targetResources{}.type as type
| stats values(displayName) by _time, type, initiatedBy, result, body.operationName
| `azure_ad_service_principal_created_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: Administrator may legitimately create Service Principal. Filter as needed.
references:
- https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
- https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-8.2.0
- https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns
- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
- https://attack.mitre.org/techniques/T1136/003/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit.log
impact: 50
kill_chain_phases:
- Exploitation
message: Service Principal named $displayName$ created by $initiatedBy$
mitre_attack_id:
- T1136.003
nist:
- DE.CM
observable:
- name: displayName
type: Other
role:
- Victim
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.properties.targetResources{}.displayName
- body.properties.targetResources{}.type
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.result
risk_score: 45
security_domain: threat
detections/cloud/azure_ad_service_principal_new_client_credentials.yml
+73
View File
@@ -0,0 +1,73 @@
name: Azure AD Service Principal New Client Credentials
id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a
version: 1
date: '2022-08-17'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: 'The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.
These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.
Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.'
search: ' `azuread` body.category=AuditLogs body.operationName="Update application*Certificates and secrets management "
| rename body.* as *
| rename properties.* as *
| rename targetResources{}.* as *
| stats values(displayName) by _time, initiatedBy.user.userPrincipalName, modifiedProperties{}.newValue
| `azure_ad_service_principal_new_client_credentials_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
log category.
known_false_positives: Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1098/001/
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/
- https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/
- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
- https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit.log
impact: 70
kill_chain_phases:
- Actions on Objectives
- Installation
message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$
mitre_attack_id:
- T1098
- T1098.001
nist:
- DE.CM
observable:
- name: displayName
type: User
role:
- Victim
- name: initiatedBy.user.userPrincipalName
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.category
- body.operationName
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.targetResources{}.displayName
- body.properties.targetResources{}.modifiedProperties{}.newValue
risk_score: 63
security_domain: threat
detections/cloud/azure_ad_service_principal_owner_added.yml
+70
View File
@@ -0,0 +1,70 @@
name: Azure AD Service Principal Owner Added
id: 7ddf2084-6cf3-4a44-be83-474f7b73c701
version: 1
date: '2022-08-30'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant.
An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment.
Service Principal authentication does not support multi-factor authentication nor conditional access policies.
Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
search: ' `azuread` body.operationName="Add owner to application"
| rename body.properties.* as *
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename targetResources{}.userPrincipalName as newOwner
| rename targetResources{}.modifiedProperties{}.newValue as displayName
| eval displayName = mvindex(displayName,1)
| where initiatedBy!=newOwner
| stats values(displayName) by _time, initiatedBy, result, body.operationName, newOwner
| `azure_ad_service_principal_owner_added_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: Administrator may legitimately add new owners for Service Principals. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1098/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit.log
impact: 60
kill_chain_phases:
- Installation
- Actions on Objectives
message: A new owner was added for service principal $displayName$ by $initiatedBy$
mitre_attack_id:
- T1098
nist:
- DE.CM
observable:
- name: displayName
type: Other
role:
- Victim
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.operationName
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.targetResources{}.userPrincipalName
- body.properties.targetResources{}.modifiedProperties{}.newValue
- body.propertiesresult
risk_score: 54
security_domain: audit
detections/cloud/azure_ad_successful_powershell_authentication.yml
+1 -1
View File
@@ -12,7 +12,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetai
| rename body.properties.* as *
| stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent
| `azure_ad_successful_powershell_authentication_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
log category.
known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed.
references:
detections/cloud/azure_ad_successful_single_factor_authentication.yml
+1 -1
View File
@@ -11,7 +11,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequ
| rename body.properties.* as *
| stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement
| `azure_ad_successful_single_factor_authentication_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
log category.
known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
references:
detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+1 -1
View File
@@ -26,7 +26,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI
| eval upperBound=(ip_avg+ip_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
log category.
known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
references:
detections/cloud/azure_ad_user_enabled_and_password_reset.yml
+65
View File
@@ -0,0 +1,65 @@
name: Azure AD User Enabled And Password Reset
id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268
version: 1
date: '2022-08-29'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: 'The following analytic identifies an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This behavior could represent
an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant.'
search: ' `azuread` (body.operationName="Enable account" OR body.operationName="Reset password (by admin)" OR body.operationName="Update user")
| transaction body.properties.targetResources{}.userPrincipalName startsWith=(body.operationName="Enable account") endsWith=(body.operationName="Reset password (by admin)") maxspan=2m
| rename body.properties.* as *
| rename targetResources{}.userPrincipalName as userPrincipalName
| rename initiatedBy.user.userPrincipalName as initiatedBy
| stats values(body.operationName) values(initiatedBy) by _time, userPrincipalName, result
| `azure_ad_user_enabled_and_password_reset_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: While not common, Administrators may enable accounts and reset their passwords for legitimate reasons. Filter as needed.
references:
- https://attack.mitre.org/techniques/T1098/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_enable_and_reset/azure-audit.log
impact: 50
kill_chain_phases:
- Installation
- Actions on Objectives
message: A user account, $displayName$, was enabled and its password reset within 2 minutes by $initiatedBy$
mitre_attack_id:
- T1098
nist:
- DE.CM
observable:
- name: displayName
type: Other
role:
- Victim
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- body.operationName
- body.properties.targetResources{}.userPrincipalName
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.result
risk_score: 45
security_domain: identity
detections/cloud/azure_ad_user_immutableid_attribute_updated.yml
+72
View File
@@ -0,0 +1,72 @@
name: Azure AD User ImmutableId Attribute Updated
id: 0c0badad-4536-4a84-a561-5ff760f3c00e
version: 1
date: '2022-09-02'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute
is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa.
Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a
single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for
email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication,
the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique
to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
search: ' `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
| rename body.properties.* as *
| rename targetResources{}.userPrincipalName as userPrincipalName
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename body.callerIpAddress as callerIpAddress
| rename targetResources{}.modifiedProperties{}.newValue as modifiedProperties
| stats values(userPrincipalName) values(modifiedProperties) by _time, initiatedBy, callerIpAddress, result, body.operationName
| `azure_ad_user_immutableid_attribute_updated_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: The SourceAnchor (also called ImmutableId) Azure AD attribute has legitimate uses for directory synchronization. Investigate and filter as needed.
references:
- https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-design-concepts
- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13
- https://o365blog.com/post/federation-vulnerability/
- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html
- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
- https://attack.mitre.org/techniques/T1098/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure Active Directory
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit.log
impact: 50
kill_chain_phases:
- Installation
- Actions on Objectives
message: The SourceAnchor or ImmutableID attribute has been modified for user $userPrincipalName$ by $initiatedBy$
mitre_attack_id:
- T1098
nist:
- DE.CM
observable:
- name: userPrincipalName
type: User
role:
- Victim
- name: initiatedBy
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
risk_score: 45
security_domain: threat
detections/cloud/azure_automation_account_created.yml
+74
View File
@@ -0,0 +1,74 @@
name: Azure Automation Account Created
id: 860902fd-2e76-46b3-b050-ba548dab576c
version: 1
date: '2022-08-18'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows
administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker.
Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities.
Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation account" status.value=Succeeded
| dedup object
| stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path
| `azure_automation_account_created_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment.
Specifically, this analytic leverages the Azure Activity log category.
known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed.
references:
- https://docs.microsoft.com/en-us/azure/automation/overview
- https://docs.microsoft.com/en-us/azure/automation/automation-create-standalone-account?tabs=azureportal
- https://docs.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker
- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
- https://attack.mitre.org/techniques/T1136/003/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity.log
impact: 70
kill_chain_phases:
- Installation
- Actions on Objectives
message: A new Azure Automation account $object$ was created by $caller$
mitre_attack_id:
- T1136
- T1136.003
nist:
- DE.CM
observable:
- name: object
type: Other
role:
- Victim
- name: caller
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- operationName.localizedValue
- status.value
- object
- caller
- claims.ipaddr
- resourceGroupName
- object_path
risk_score: 63
security_domain: audit
detections/cloud/azure_automation_runbook_created.yml
+73
View File
@@ -0,0 +1,73 @@
name: Azure Automation Runbook Created
id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b
version: 1
date: '2022-08-22'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows
administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python.
Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded
| dedup object
| stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path
| `azure_automation_runbook_created_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment.
Specifically, this analytic leverages the Azure Activity log category.
known_false_positives: Administrators may legitimately create Azure Automation Runbooks. Filter as needed.
references:
- https://docs.microsoft.com/en-us/azure/automation/overview
- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
- https://docs.microsoft.com/en-us/azure/automation/manage-runbooks
- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
- https://attack.mitre.org/techniques/T1136/003/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques//T1078.004/azure_automation_runbook/azure-activity.log
impact: 70
kill_chain_phases:
- Installation
- Actions on Objectives
message: A new Azure Automation Runbook $object$ was created by $caller$
mitre_attack_id:
- T1136
- T1136.003
nist:
- DE.CM
observable:
- name: object
type: Other
role:
- Victim
- name: caller
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- operationName.localizedValue
- status.value
- object
- caller
- claims.ipaddr
- resourceGroupName
- object_path
risk_score: 63
security_domain: audit
detections/cloud/azure_runbook_webhook_created.yml
+73
View File
@@ -0,0 +1,73 @@
name: Azure Runbook Webhook Created
id: e98944a9-92e4-443c-81b8-a322e33ce75a
version: 1
date: '2022-08-23'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows
administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python.
One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet.
An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM.
This provides a persistent foothold on the environment.
search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded
| stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path
| `azure_runbook_webhook_created_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment.
Specifically, this analytic leverages the Azure Activity log category.
known_false_positives: Administrators may legitimately create Azure Runbook Webhooks. Filter as needed.
references:
- https://docs.microsoft.com/en-us/azure/automation/overview
- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
- https://docs.microsoft.com/en-us/azure/automation/automation-webhooks?tabs=portal
- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
- https://attack.mitre.org/techniques/T1078/004/
tags:
analytic_story:
- Azure Active Directory Persistence
asset_type: Azure
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Cloud Data
- Stage:Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity.log
impact: 70
kill_chain_phases:
- Exploitation
message: A new Azure Runbook Webhook $object$ was created by $caller$
mitre_attack_id:
- T1078
- T1078.004
nist:
- DE.CM
observable:
- name: object
type: Other
role:
- Victim
- name: caller
type: User
role:
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- operationName.localizedValue
- status.value
- object
- caller
- claims.ipaddr
- resourceGroupName
- object_path
risk_score: 63
security_domain: threat
lookups/privileged_azure_ad_roles.csv
+29
View File
@@ -0,0 +1,29 @@
azureadrole,isprvilegedadrole,description
"""Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps.
"""Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user.
"""Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.
"""Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices.
"""Azure DevOps Administrator""",True,Can manage Azure DevOps policies and settings.
"""Azure Information Protection Administrator""",True,Can manage all aspects of the Azure Information Protection product.
"""Cloud Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps except App Proxy.
"""Cloud Device Administrator""",True,Limited access to manage devices in Azure AD.
"""Compliance Administrator""",True,Can read and manage compliance configuration and reports in Azure AD and Microsoft 365.
"""Conditional Access Administrator""",True,Can manage Conditional Access capabilities.
"""Exchange Administrator""",True,Can manage all aspects of the Exchange product.
"""External Identity Provider Administrator""",True,Can configure identity providers for use in direct federation.
"""Groups Administrator""",True,Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.
"""Helpdesk Administrator""",True,Can reset passwords for non-administrators and Helpdesk Administrators.
"""Hybrid Identity Administrator""",True,Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings.
"""Intune Administrator""",True,Can manage all aspects of the Intune product.
"""License Administrator""",True,Can manage product licenses on users and groups.
"""Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications.
"""Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators.
"""Privileged Authentication Administrator""",True,Can access to view, set and reset authentication method information for any user (admin or non-admin).
"""Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management.
"""Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365.
"""SharePoint Administrator""",True,Can manage all aspects of the SharePoint service.
"""Teams Administrator""",True,Can manage the Microsoft Teams service.
"""User Administrator""",True,Can manage all aspects of users and groups, including resetting passwords for limited admins.
"""Windows 365 Administrator""",True,Can provision and manage all aspects of Cloud PCs.
1 azureadrole isprvilegedadrole description
2 "Application Administrator" True Can create and manage all aspects of app registrations and enterprise apps.
3 "Authentication Administrator" True Can access to view set and reset authentication method information for any non-admin user.
4 "Authentication Policy Administrator" True Can create and manage the authentication methods policy tenant-wide MFA settings password protection policy and verifiable credentials.
5 "Azure AD Joined Device Local Administrator" True Users assigned to this role are added to the local administrators group on Azure AD-joined devices.
6 "Azure DevOps Administrator" True Can manage Azure DevOps policies and settings.
7 "Azure Information Protection Administrator" True Can manage all aspects of the Azure Information Protection product.
8 "Cloud Application Administrator" True Can create and manage all aspects of app registrations and enterprise apps except App Proxy.
9 "Cloud Device Administrator" True Limited access to manage devices in Azure AD.
10 "Compliance Administrator" True Can read and manage compliance configuration and reports in Azure AD and Microsoft 365.
11 "Conditional Access Administrator" True Can manage Conditional Access capabilities.
12 "Exchange Administrator" True Can manage all aspects of the Exchange product.
13 "External Identity Provider Administrator" True Can configure identity providers for use in direct federation.
14 "Groups Administrator" True Members of this role can create/manage groups create/manage groups settings like naming and expiration policies and view groups activity and audit reports.
15 "Helpdesk Administrator" True Can reset passwords for non-administrators and Helpdesk Administrators.
16 "Hybrid Identity Administrator" True Can manage AD to Azure AD cloud provisioning Azure AD Connect Pass-through Authentication (PTA) Password hash synchronization (PHS) Seamless Single sign-on (Seamless SSO) and federation settings.
17 "Intune Administrator" True Can manage all aspects of the Intune product.
18 "License Administrator" True Can manage product licenses on users and groups.
19 "Network Administrator" True Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications.
20 "Password Administrator" True Can reset passwords for non-administrators and Password Administrators.
21 "Privileged Authentication Administrator" True Can access to view set and reset authentication method information for any user (admin or non-admin).
22 "Privileged Role Administrator" True Can manage role assignments in Azure AD and all aspects of Privileged Identity Management.
23 "Security Administrator" True Can read security information and reports and manage configuration in Azure AD and Office 365.
24 "SharePoint Administrator" True Can manage all aspects of the SharePoint service.
25 "Teams Administrator" True Can manage the Microsoft Teams service.
26 "User Administrator" True Can manage all aspects of users and groups including resetting passwords for limited admins.
27 "Windows 365 Administrator" True Can provision and manage all aspects of Cloud PCs.
lookups/privileged_azure_ad_roles.yml
+7
View File
@@ -0,0 +1,7 @@
description: A list of privileged Azure Active Directory roles.
filename: privileged_azure_ad_roles.csv
name: privileged_azure_ad_roles
default_match: 'false'
match_type: WILDCARD(azureadrole)
min_matches: 1
case_sensitive_match: 'false'
macros/azure_audit.yml
+4
View File
@@ -0,0 +1,4 @@
definition: sourcetype=mscs:azure:audit
description: customer specific splunk configurations(eg- index, source, sourcetype).
Replace the macro definition with configurations for your Splunk Environmnent.
name: azure_audit
stories/azure_active_directory_persistence.yml
+29
View File
@@ -0,0 +1,29 @@
name: Azure Active Directory Persistence
id: dca983db-6334-4a0d-be32-80611ca1396c
version: 1
date: '2022-08-17'
author: Mauricio Velazco, Splunk
description: Monitor for activities and techniques associated with the execution of Persistence
techniques against Azure Active Directory tenants.
narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure
services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol.
According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access.
This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants.
'
references:
- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis
- https://azure.microsoft.com/en-us/services/active-directory/#overview
- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad
- https://attack.mitre.org/tactics/TA0003/
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/
tags:
analytic_story: Azure Active Directory Persistence
category:
- Cloud Security
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
usecase: Advanced Threat Detection
tests/cloud/azure_ad_external_guest_user_invited.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure AD External Guest User Invited Unit Test
tests:
- name: Azure AD External Guest User Invited
file: cloud/azure_ad_external_guest_user_invited.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_global_administrator_role_assigned.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure AD Global Administrator Role Assigned Unit Test
tests:
- name: Azure AD Global Administrator Role Assigned
file: cloud/azure_ad_global_administrator_role_assigned.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_new_custom_domain_added.test.yml
+14
View File
@@ -0,0 +1,14 @@
name: Azure AD New Custom Domain Added Unit Test
tests:
- name: Azure AD New Custom Domain Added
file: cloud/azure_ad_new_custom_domain_added.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_new_federated_domain_added.test.yml
+14
View File
@@ -0,0 +1,14 @@
name: Azure AD New Federated Domain Added Unit Test
tests:
- name: Azure AD New Federated Domain Added
file: cloud/azure_ad_new_federated_domain_added.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_privileged_role_assigned.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure AD Privileged Role Assigned Unit Test
tests:
- name: Azure AD Privileged Role Assigned
file: cloud/azure_ad_privileged_role_assigned.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_service_principal_created.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure AD Service Principal Created Unit Test
tests:
- name: Azure AD Service Principal Created
file: cloud/azure_ad_service_principal_created.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_service_principal_new_client_credentials.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure AD Service Principal New Client Credentials Unit Test
tests:
- name: Azure AD Service Principal New Client Credentials
file: cloud/azure_ad_service_principal_new_client_credentials.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_service_principal_owner_added.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure AD Service Principal Owner Added Unit Test
tests:
- name: Azure AD Service Principal Owner Added
file: cloud/azure_ad_service_principal_owner_added.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_user_enabled_and_password_reset.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure AD User Enabled And Password Reset Unit Test
tests:
- name: Azure AD User Enabled And Password Reset
file: cloud/azure_ad_user_enabled_and_password_reset.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_enable_and_reset/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_ad_user_immutableid_attribute_updated.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure AD User ImmutableId Attribute Updated Unit Test
tests:
- name: Azure AD User ImmutableId Attribute Updated
file: cloud/azure_ad_user_immutableid_attribute_updated.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-audit.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit.log
source: mscs:azure:eventhub
sourcetype: mscs:azure:eventhub
update_timestamp: true
tests/cloud/azure_automation_account_created.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure Automation Account Created Unit Test
tests:
- name: Azure Automation Account Created
file: cloud/azure_automation_account_created.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-activity.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity.log
source: mscs:azure:audit
sourcetype: mscs:azure:audit
update_timestamp: true
tests/cloud/azure_automation_runbook_created.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure Automation Runbook Created Unit Test
tests:
- name: Azure Automation Runbook Created
file: cloud/azure_automation_runbook_created.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-activity.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity.log
source: mscs:azure:audit
sourcetype: mscs:azure:audit
update_timestamp: true
tests/cloud/azure_runbook_webhook_created.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Azure Runbook Webhook Created Unit Test
tests:
- name: Azure Runbook Webhook Created
file: cloud/azure_runbook_webhook_created.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: azure-activity.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity.log
source: mscs:azure:audit
sourcetype: mscs:azure:audit
update_timestamp: true