From 7174360ceea70519e689cf511fa4239ae32f2fd6 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 17 Aug 2022 12:22:16 -0400 Subject: [PATCH 01/23] creating analytic story yaml --- stories/azure_active_directory_persistence.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 stories/azure_active_directory_persistence.yml diff --git a/stories/azure_active_directory_persistence.yml b/stories/azure_active_directory_persistence.yml new file mode 100644 index 0000000000..ff40991384 --- /dev/null +++ b/stories/azure_active_directory_persistence.yml @@ -0,0 +1,17 @@ +name: Azure Active Directory Persistence +id: dca983db-6334-4a0d-be32-80611ca1396c +version: 1 +date: '2022-08-17' +author: Mauricio Velazco, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + analytic_story: Azure Active Directory Persistence + category: + - Cloud Security + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 41a7f4380ed63cc2d93c7d72354dab279b075f86 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Wed, 17 Aug 2022 18:43:40 -0400 Subject: [PATCH 02/23] Add 2 detections --- ..._ad_global_administrator_role_assigned.yml | 66 ++++++++++++++++++ .../azure_ad_service_principal_created.yml | 69 +++++++++++++++++++ ...lobal_administrator_role_assigned.test.yml | 13 ++++ ...zure_ad_service_principal_created.test.yml | 13 ++++ 4 files changed, 161 insertions(+) create mode 100644 detections/cloud/azure_ad_global_administrator_role_assigned.yml create mode 100644 detections/cloud/azure_ad_service_principal_created.yml create mode 100644 tests/cloud/azure_ad_global_administrator_role_assigned.test.yml create mode 100644 tests/cloud/azure_ad_service_principal_created.test.yml diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml new file mode 100644 index 0000000000..fae07b086e --- /dev/null +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -0,0 +1,66 @@ +name: Azure AD Global Administrator Role Assigned +id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c +version: 1 +date: '2022-08-17' +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies when an Administrator assign Global Administrator role to a user. + Global Admin role is the most powerfull administrator role in Azure AD. It is (almost) equivalent to the local system rigths in traditional Windows environment. + Attackers may use this technique to create Persistence in the Azure AD environment. Adding Global Administrator role is not the best security practice as well as not a common practice. +search: '`azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global Administrator\"" + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.type as type + | stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName + | `azure_ad_global_administrator_role_assigned_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrator may legitimately assign Global Admin to a user. Filter as needed. +references: +- https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns +- https://attack.mitre.org/techniques/T1098/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit.log + impact: 80 + kill_chain_phases: + - Exploitation + message: Global Administrator Role assigned for User $userPrincipalName$ initiated by $initiatedBy$ + mitre_attack_id: + - T1098.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.targetResources{}.userPrincipalName + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 72 + security_domain: threat diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml new file mode 100644 index 0000000000..98fbde0da0 --- /dev/null +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -0,0 +1,69 @@ +name: Azure AD Service Principal Created +id: f8ba49e7-ffd3-4b53-8f61-e73974583c5d +version: 1 +date: '2022-08-17' +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies when a Service Principal is created. + An Azure service principal is an identity designed for use with apps, services, and automated tools to access resources. + This access is restricted by the roles assigned to the service principal, giving you control over which resources can be accessed and at which level. + It's advised to employ service principals with automated tools rather than letting them log in using user identities for security concerns. + Attackers can use this method to create Persistence in the Azure AD environment and login whenever they want. +search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=* + | rename body.properties.* as * + | rename targetResources{}.displayName as displayName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.type as type + | stats values(displayName) by _time, type, initiatedBy, result, body.operationName + | `azure_ad_service_principal_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrator may legitimately create Service Principal. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals +- https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-8.2.0 +- https://attack.mitre.org/techniques/T1136/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit.log + impact: 50 + kill_chain_phases: + - Exploitation + message: Service Principal named $displayName$ created by $initiatedBy$ + mitre_attack_id: + - T1136.003 + nist: + - DE.CM + observable: + - name: displayName + type: Application + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.targetResources{}.displayName + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 45 + security_domain: threat diff --git a/tests/cloud/azure_ad_global_administrator_role_assigned.test.yml b/tests/cloud/azure_ad_global_administrator_role_assigned.test.yml new file mode 100644 index 0000000000..11128d6839 --- /dev/null +++ b/tests/cloud/azure_ad_global_administrator_role_assigned.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Global Administrator Role Assigned Unit Test +tests: +- name: Azure AD Global Administrator Role Assigned + file: cloud/azure_ad_global_administrator_role_assigned.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_ad_service_principal_created.test.yml b/tests/cloud/azure_ad_service_principal_created.test.yml new file mode 100644 index 0000000000..64b312a62b --- /dev/null +++ b/tests/cloud/azure_ad_service_principal_created.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Service Principal Created Unit Test +tests: +- name: Azure AD Service Principal Created + file: cloud/azure_ad_service_principal_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From da48c720c6ab0155df8b3de62687d3e80a627e9c Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Wed, 17 Aug 2022 18:53:22 -0400 Subject: [PATCH 03/23] Update "Azure AD Service Principal Created" --- detections/cloud/azure_ad_service_principal_created.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index 98fbde0da0..6d879d8054 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -41,7 +41,7 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: Service Principal named $displayName$ created by $initiatedBy$ + message: Service Principal named $displayName$ created by $initiatedBy$ mitre_attack_id: - T1136.003 nist: From 55c18d0c40e419b8f1f0409a1432497eccad9a28 Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Wed, 17 Aug 2022 18:54:10 -0400 Subject: [PATCH 04/23] Update "Azure AD Service Principal Created" --- detections/cloud/azure_ad_service_principal_created.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index 6d879d8054..44e9143c5f 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -48,7 +48,7 @@ tags: - DE.CM observable: - name: displayName - type: Application + type: Other role: - Victim - name: initiatedBy From 7b137ad6b9012e28edc3678a103ab303291d7715 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 18 Aug 2022 14:50:16 -0400 Subject: [PATCH 05/23] adding new detection and fixing a few others --- ...entication_failed_during_mfa_challenge.yml | 2 +- ..._users_failing_to_authenticate_from_ip.yml | 3 +- ...rvice_principal_new_client_credentials.yml | 71 +++++++++++++++++++ ...d_successful_powershell_authentication.yml | 2 +- ...uccessful_single_factor_authentication.yml | 2 +- ...mber_of_failed_authentications_from_ip.yml | 2 +- .../azure_active_directory_persistence.yml | 18 ++++- ..._principal_new_client_credentials.test.yml | 13 ++++ 8 files changed, 105 insertions(+), 8 deletions(-) create mode 100644 detections/cloud/azure_ad_service_principal_new_client_credentials.yml create mode 100644 tests/cloud/azure_ad_service_principal_new_client_credentials.test.yml diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index e53f414612..1a400884f6 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -12,7 +12,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50 | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. references: diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 01d0c876ed..62c94fce3a 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -17,7 +17,8 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs. log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml new file mode 100644 index 0000000000..99490d6531 --- /dev/null +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -0,0 +1,71 @@ +name: Azure AD Service Principal New Client Credentials +id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a +version: 1 +date: '2022-08-17' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. + These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. + Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.' +search: ' `azuread` body.category=AuditLogs body.operationName="Update application*Certificates and secrets management " + | rename body.* as * + | rename properties.* as * + | rename targetResources{}.* as * + | stats values(displayName) by _time, initiatedBy.user.userPrincipalName, modifiedProperties{}.newValue + | `azure_ad_service_principal_new_client_credentials_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1098/001/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/ +- https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + - Installation + message: UPDATE message + mitre_attack_id: + - T1098 + - T1098.001 + nist: + - DE.CM + observable: + - name: displayName + type: User + role: + - Victim + - name: initiatedBy.user.userPrincipalName + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.category + - body.operationName + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.targetResources{}.displayName + - body.properties.targetResources{}.modifiedProperties{}.newValue + risk_score: 63 + security_domain: threat diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index c67bf0500c..64a8557e95 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -12,7 +12,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetai | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent | `azure_ad_successful_powershell_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed. references: diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index e86cbcc422..9f96956096 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -11,7 +11,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequ | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement | `azure_ad_successful_single_factor_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed references: diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index dabd3a2a14..ded1815871 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -26,7 +26,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: diff --git a/stories/azure_active_directory_persistence.yml b/stories/azure_active_directory_persistence.yml index ff40991384..9bf08fe735 100644 --- a/stories/azure_active_directory_persistence.yml +++ b/stories/azure_active_directory_persistence.yml @@ -3,9 +3,21 @@ id: dca983db-6334-4a0d-be32-80611ca1396c version: 1 date: '2022-08-17' author: Mauricio Velazco, Splunk -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE -references: [] +description: Monitor for activities and techniques associated with the execution of Persistence + techniques against Azure Active Directory tenants. +narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure + services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. + According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ + Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. + This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory accounts. + ' +references: +- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis +- https://azure.microsoft.com/en-us/services/active-directory/#overview +- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad +- https://attack.mitre.org/tactics/TA0003/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/ + tags: analytic_story: Azure Active Directory Persistence category: diff --git a/tests/cloud/azure_ad_service_principal_new_client_credentials.test.yml b/tests/cloud/azure_ad_service_principal_new_client_credentials.test.yml new file mode 100644 index 0000000000..0cab12d259 --- /dev/null +++ b/tests/cloud/azure_ad_service_principal_new_client_credentials.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Service Principal New Client Credentials Unit Test +tests: +- name: Azure AD Service Principal New Client Credentials + file: cloud/azure_ad_service_principal_new_client_credentials.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From b81b41e137c4aee4e87ff971e2249d7531a684f0 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 18 Aug 2022 17:46:34 -0400 Subject: [PATCH 06/23] small fixes --- .../azure_ad_global_administrator_role_assigned.yml | 13 ++++++++----- .../cloud/azure_ad_service_principal_created.yml | 10 +++++----- ..._ad_service_principal_new_client_credentials.yml | 2 +- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml index fae07b086e..7ba6486358 100644 --- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -5,9 +5,9 @@ date: '2022-08-17' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies when an Administrator assign Global Administrator role to a user. - Global Admin role is the most powerfull administrator role in Azure AD. It is (almost) equivalent to the local system rigths in traditional Windows environment. - Attackers may use this technique to create Persistence in the Azure AD environment. Adding Global Administrator role is not the best security practice as well as not a common practice. +description: The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. + The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. + Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment. search: '`azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global Administrator\"" | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName @@ -17,9 +17,12 @@ search: '`azuread` "body.operationName"="Add member to role" "body.properties.t | `azure_ad_global_administrator_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category. -known_false_positives: Administrator may legitimately assign Global Admin to a user. Filter as needed. +known_false_positives: Although rare, Administrators may legitimately assign the Global Administrator role to a user. Filter as needed. references: -- https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns +- https://o365blog.com/post/admin/ +- https://adsecurity.org/?p=4277 +- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors +- https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning - https://attack.mitre.org/techniques/T1098/003/ tags: analytic_story: diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index 44e9143c5f..a112900da2 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -5,11 +5,10 @@ date: '2022-08-17' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies when a Service Principal is created. - An Azure service principal is an identity designed for use with apps, services, and automated tools to access resources. - This access is restricted by the roles assigned to the service principal, giving you control over which resources can be accessed and at which level. - It's advised to employ service principals with automated tools rather than letting them log in using user identities for security concerns. - Attackers can use this method to create Persistence in the Azure AD environment and login whenever they want. +description: The following analytic identifies the creation of a Service Principal in an Azure AD environment. + An Azure Service Principal is an identity designed for use with apps, services, and automated tools to access resources. + This access is restricted by the roles assigned to the Service Principal, giving users control over which resources can be accessed and at which level. + Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence in the Azure AD environment. search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=* | rename body.properties.* as * | rename targetResources{}.displayName as displayName @@ -23,6 +22,7 @@ known_false_positives: Administrator may legitimately create Service Principal. references: - https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals - https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-8.2.0 +- https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns - https://attack.mitre.org/techniques/T1136/003/ tags: analytic_story: diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml index 99490d6531..48ae7e8ce5 100644 --- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -41,7 +41,7 @@ tags: kill_chain_phases: - Actions on Objectives - Installation - message: UPDATE message + message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$ mitre_attack_id: - T1098 - T1098.001 From fae2c64476899263dbab3b06b398be485dccc3cf Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 19 Aug 2022 00:16:18 -0400 Subject: [PATCH 07/23] adding new detection. other minor changes --- .../azure_ad_automation_account_created.yml | 53 +++++++++++++++++++ ..._ad_global_administrator_role_assigned.yml | 4 +- .../azure_ad_service_principal_created.yml | 5 +- ...rvice_principal_new_client_credentials.yml | 1 + ...ure_ad_automation_account_created.test.yml | 13 +++++ 5 files changed, 73 insertions(+), 3 deletions(-) create mode 100644 detections/cloud/azure_ad_automation_account_created.yml create mode 100644 tests/cloud/azure_ad_automation_account_created.test.yml diff --git a/detections/cloud/azure_ad_automation_account_created.yml b/detections/cloud/azure_ad_automation_account_created.yml new file mode 100644 index 0000000000..434f539a1e --- /dev/null +++ b/detections/cloud/azure_ad_automation_account_created.yml @@ -0,0 +1,53 @@ +name: Azure AD Automation Account Created +id: 860902fd-2e76-46b3-b050-ba548dab576c +version: 1 +date: '2022-08-18' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `azuread` + + | `azure_ad_automation_account_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed. +references: +- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ +- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Update context + dataset: + - UPDATE_DATASET_URL + impact: 70 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: UPDATE + type: UPDATE + role: + - UPDATE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + risk_score: 63 + security_domain: audit diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml index 7ba6486358..90ea739616 100644 --- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -7,6 +7,7 @@ type: TTP datamodel: [] description: The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. + While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment. search: '`azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global Administrator\"" | rename body.properties.* as * @@ -17,12 +18,13 @@ search: '`azuread` "body.operationName"="Add member to role" "body.properties.t | `azure_ad_global_administrator_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category. -known_false_positives: Although rare, Administrators may legitimately assign the Global Administrator role to a user. Filter as needed. +known_false_positives: Administrators may legitimately assign the Global Administrator role to a user. Filter as needed. references: - https://o365blog.com/post/admin/ - https://adsecurity.org/?p=4277 - https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors - https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning +- https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin - https://attack.mitre.org/techniques/T1098/003/ tags: analytic_story: diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index a112900da2..04b49f2fae 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -6,9 +6,9 @@ author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic identifies the creation of a Service Principal in an Azure AD environment. - An Azure Service Principal is an identity designed for use with apps, services, and automated tools to access resources. + An Azure Service Principal is an identity designed for use with apps, services, and automated tools to access resources. Service Principal authentication does not support multi-factor authentication. This access is restricted by the roles assigned to the Service Principal, giving users control over which resources can be accessed and at which level. - Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence in the Azure AD environment. + Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=* | rename body.properties.* as * | rename targetResources{}.displayName as displayName @@ -23,6 +23,7 @@ references: - https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals - https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-8.2.0 - https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns +- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html - https://attack.mitre.org/techniques/T1136/003/ tags: analytic_story: diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml index 48ae7e8ce5..bd1b84688d 100644 --- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -22,6 +22,7 @@ references: - https://attack.mitre.org/techniques/T1098/001/ - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/ - https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/ +- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html tags: analytic_story: - Azure Active Directory Persistence diff --git a/tests/cloud/azure_ad_automation_account_created.test.yml b/tests/cloud/azure_ad_automation_account_created.test.yml new file mode 100644 index 0000000000..2d09bce623 --- /dev/null +++ b/tests/cloud/azure_ad_automation_account_created.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Automation Account Created Unit Test +tests: +- name: Azure AD Automation Account Created + file: cloud/azure_ad_automation_account_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true From 136cbb1ea84ebc26938fd26832c987f71503611c Mon Sep 17 00:00:00 2001 From: gowthamarajr Date: Fri, 19 Aug 2022 10:39:07 -0400 Subject: [PATCH 08/23] Add detection for "Azure AD External Guest User Invited" --- .../azure_ad_external_guest_user_invited.yml | 67 +++++++++++++++++++ ...re_ad_external_guest_user_invited.test.yml | 13 ++++ 2 files changed, 80 insertions(+) create mode 100644 detections/cloud/azure_ad_external_guest_user_invited.yml create mode 100644 tests/cloud/azure_ad_external_guest_user_invited.test.yml diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml new file mode 100644 index 0000000000..19d646b9ff --- /dev/null +++ b/detections/cloud/azure_ad_external_guest_user_invited.yml @@ -0,0 +1,67 @@ +name: Azure AD External Guest User Invited +id: c1fb4edb-cab1-4359-9b40-925ffd797fb5 +version: 1 +date: '2022-08-18' +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the creation of a account for External Guest User through invitation. + With Azure AD B2B collaboration, you can invite anyone to collaborate with your organization using their own work, school, or social account. + Adversaries and red teams alike who have obtained administrative access may invite an External Guest User to establish Persistence and obtain single-factor access to an Azure AD environment. +search: '`azuread` "body.operationName"="Invite external user" + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.type as type + | stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName + | `azure_ad_external_guest_user_invited_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrator may legitimately invite external guest users. Filter as needed. +references: +- https://dirkjanm.io/assets/raw/US-22-Mollema-Backdooring-and-hijacking-Azure-AD-accounts_final.pdf +- https://attack.mitre.org/techniques/T1136/003/ +- https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit.log + impact: 50 + kill_chain_phases: + - Exploitation + message: External Guest User $userPrincipalName$ initiated by $initiatedBy$ + mitre_attack_id: + - T1136.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.targetResources{}.userPrincipalName + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 45 + security_domain: threat diff --git a/tests/cloud/azure_ad_external_guest_user_invited.test.yml b/tests/cloud/azure_ad_external_guest_user_invited.test.yml new file mode 100644 index 0000000000..9604be850d --- /dev/null +++ b/tests/cloud/azure_ad_external_guest_user_invited.test.yml @@ -0,0 +1,13 @@ +name: Azure AD External Guest User Invited Unit Test +tests: +- name: Azure AD External Guest User Invited + file: cloud/azure_ad_external_guest_user_invited.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 0a10ef85d6cbc47c7baaa4b3b0939f64bb62a63e Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 22 Aug 2022 15:36:25 -0400 Subject: [PATCH 09/23] fixing detection. adding azure_audit macro --- .../azure_ad_automation_account_created.yml | 53 ------------- .../azure_automation_account_created.yml | 74 +++++++++++++++++++ macros/azure_audit.yml | 4 + ...ure_ad_automation_account_created.test.yml | 13 ---- .../azure_automation_account_created.test.yml | 13 ++++ 5 files changed, 91 insertions(+), 66 deletions(-) delete mode 100644 detections/cloud/azure_ad_automation_account_created.yml create mode 100644 detections/cloud/azure_automation_account_created.yml create mode 100644 macros/azure_audit.yml delete mode 100644 tests/cloud/azure_ad_automation_account_created.test.yml create mode 100644 tests/cloud/azure_automation_account_created.test.yml diff --git a/detections/cloud/azure_ad_automation_account_created.yml b/detections/cloud/azure_ad_automation_account_created.yml deleted file mode 100644 index 434f539a1e..0000000000 --- a/detections/cloud/azure_ad_automation_account_created.yml +++ /dev/null @@ -1,53 +0,0 @@ -name: Azure AD Automation Account Created -id: 860902fd-2e76-46b3-b050-ba548dab576c -version: 1 -date: '2022-08-18' -author: Mauricio Velazco, Splunk -type: TTP -datamodel: [] -description: UPDATE_DESCRIPTION -search: ' `azuread` - - | `azure_ad_automation_account_created_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. - Specifically, this analytic leverages the AuditLogs log category. -known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed. -references: -- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ -- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ -- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html -tags: - analytic_story: - - Azure Active Directory Persistence - asset_type: Azure Active Directory - cis20: - - CIS 3 - - CIS 5 - - CIS 16 - confidence: 90 - context: - - Update context - dataset: - - UPDATE_DATASET_URL - impact: 70 - kill_chain_phases: - - Installation - - Actions on Objectives - message: UPDATE message - mitre_attack_id: - - T1003.002 - nist: - - DE.CM - observable: - - name: UPDATE - type: UPDATE - role: - - UPDATE - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - risk_score: 63 - security_domain: audit diff --git a/detections/cloud/azure_automation_account_created.yml b/detections/cloud/azure_automation_account_created.yml new file mode 100644 index 0000000000..69460abb27 --- /dev/null +++ b/detections/cloud/azure_automation_account_created.yml @@ -0,0 +1,74 @@ +name: Azure Automation Account Created +id: 860902fd-2e76-46b3-b050-ba548dab576c +version: 1 +date: '2022-08-18' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows + administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker. + Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities. + Once adversaries have obtained privileged access to an Azure tenant, they may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. +search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation account" status.value=Succeeded + | dedup object + | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path + | `azure_automation_account_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/automation/overview +- https://docs.microsoft.com/en-us/azure/automation/automation-create-standalone-account?tabs=azureportal +- https://docs.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker +- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html +- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ +- https://attack.mitre.org/techniques/T1136/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity.log + impact: 70 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new Azure Automation account $object$ was created by $caller$ + mitre_attack_id: + - T1136 + - T1136.003 + nist: + - DE.CM + observable: + - name: object + type: Other + role: + - Victim + - name: caller + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - operationName.localizedValue + - status.value + - object + - caller + - claims.ipaddr + - resourceGroupName + - object_path + risk_score: 63 + security_domain: audit diff --git a/macros/azure_audit.yml b/macros/azure_audit.yml new file mode 100644 index 0000000000..80b295bfe4 --- /dev/null +++ b/macros/azure_audit.yml @@ -0,0 +1,4 @@ +definition: sourcetype=mscs:azure:audit +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: azure_audit diff --git a/tests/cloud/azure_ad_automation_account_created.test.yml b/tests/cloud/azure_ad_automation_account_created.test.yml deleted file mode 100644 index 2d09bce623..0000000000 --- a/tests/cloud/azure_ad_automation_account_created.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Azure AD Automation Account Created Unit Test -tests: -- name: Azure AD Automation Account Created - file: cloud/azure_ad_automation_account_created.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE - update_timestamp: true diff --git a/tests/cloud/azure_automation_account_created.test.yml b/tests/cloud/azure_automation_account_created.test.yml new file mode 100644 index 0000000000..129e94582a --- /dev/null +++ b/tests/cloud/azure_automation_account_created.test.yml @@ -0,0 +1,13 @@ +name: Azure Automation Account Created Unit Test +tests: +- name: Azure Automation Account Created + file: cloud/azure_automation_account_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-activity.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity.log + source: mscs:azure:audit + sourcetype: mscs:azure:audit + update_timestamp: true From 63f87f5a12b265c2fbf16f12f5684beff1ca16cf Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Aug 2022 16:28:55 -0400 Subject: [PATCH 10/23] adding new detection --- .../azure_automation_account_created.yml | 2 +- .../azure_automation_runbook_created.yml | 73 +++++++++++++++++++ .../azure_automation_runbook_created.test.yml | 13 ++++ 3 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_automation_runbook_created.yml create mode 100644 tests/cloud/azure_automation_runbook_created.test.yml diff --git a/detections/cloud/azure_automation_account_created.yml b/detections/cloud/azure_automation_account_created.yml index 69460abb27..bc3638165c 100644 --- a/detections/cloud/azure_automation_account_created.yml +++ b/detections/cloud/azure_automation_account_created.yml @@ -14,7 +14,7 @@ search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path | `azure_automation_account_created_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. - Specifically, this analytic leverages the AuditLogs log category. + Specifically, this analytic leverages the Azure Activity log category. known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed. references: - https://docs.microsoft.com/en-us/azure/automation/overview diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml new file mode 100644 index 0000000000..346e9d3a1e --- /dev/null +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -0,0 +1,73 @@ +name: Azure Automation Runbook Created +id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b +version: 1 +date: '2022-08-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows + administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. + Once adversaries have obtained privileged access to an Azure tenant, they may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. +search: ' `azure_audit index=main operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded + | dedup object + | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path` + | `azure_automation_runbook_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. + Specifically, this analytic leverages the Azure Activity log category. +known_false_positives: Administrators may legitimately create Azure Automation Runbooks. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/automation/overview +- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types +- https://docs.microsoft.com/en-us/azure/automation/manage-runbooks +- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html +- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ +- https://attack.mitre.org/techniques/T1136/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log + impact: 70 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new Azure Automation Runbook $object$ was created by $caller$ + mitre_attack_id: + - T1136 + - T1136.003 + nist: + - DE.CM + observable: + - name: object + type: Other + role: + - Victim + - name: caller + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - operationName.localizedValue + - status.value + - object + - caller + - claims.ipaddr + - resourceGroupName + - object_path + risk_score: 63 + security_domain: audit diff --git a/tests/cloud/azure_automation_runbook_created.test.yml b/tests/cloud/azure_automation_runbook_created.test.yml new file mode 100644 index 0000000000..e9a5a853fe --- /dev/null +++ b/tests/cloud/azure_automation_runbook_created.test.yml @@ -0,0 +1,13 @@ +name: Azure Automation Runbook Created Unit Test +tests: +- name: Azure Automation Runbook Created + file: cloud/azure_automation_runbook_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-activity.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log + source: mscs:azure:audit + sourcetype: mscs:azure:audit + update_timestamp: true From 0a6592b9e2650b69bcc38fe6c11feb3af00b2410 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Aug 2022 21:45:22 -0400 Subject: [PATCH 11/23] adding new detection. fixing another --- .../azure_automation_runbook_created.yml | 2 +- .../cloud/azure_runbook_webhook_created.yml | 47 +++++++++++++++++++ .../azure_runbook_webhook_created.test.yml | 13 +++++ 3 files changed, 61 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_runbook_webhook_created.yml create mode 100644 tests/cloud/azure_runbook_webhook_created.test.yml diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml index 346e9d3a1e..7f9f661c3b 100644 --- a/detections/cloud/azure_automation_runbook_created.yml +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -8,7 +8,7 @@ datamodel: [] description: The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. Once adversaries have obtained privileged access to an Azure tenant, they may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. -search: ' `azure_audit index=main operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded +search: ' `azure_audit operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded | dedup object | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path` | `azure_automation_runbook_created_filter`' diff --git a/detections/cloud/azure_runbook_webhook_created.yml b/detections/cloud/azure_runbook_webhook_created.yml new file mode 100644 index 0000000000..3bce82ecb3 --- /dev/null +++ b/detections/cloud/azure_runbook_webhook_created.yml @@ -0,0 +1,47 @@ +name: Azure Runbook Webhook Created +id: e98944a9-92e4-443c-81b8-a322e33ce75a +version: 1 +date: '2022-08-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: '| UPDATE_SPL | `azure_runbook_webhook_created_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- REFERENCE +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: UPDATE asset_type + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: UPDATE value between 1-100 + context: + - Update context + dataset: + - UPDATE_DATASET_URL + impact: UPDATE value between 1-100 + kill_chain_phases: + - Exploitation + message: UPDATE message + mitre_attack_id: + - T100 + nist: + - DE.CM + observable: + - name: UPDATE + type: UPDATE + role: + - UPDATE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - UPDATE + risk_score: UPDATE (impact * confidence)/100 + security_domain: threat diff --git a/tests/cloud/azure_runbook_webhook_created.test.yml b/tests/cloud/azure_runbook_webhook_created.test.yml new file mode 100644 index 0000000000..92f73b4b4a --- /dev/null +++ b/tests/cloud/azure_runbook_webhook_created.test.yml @@ -0,0 +1,13 @@ +name: Azure Runbook Webhook Created Unit Test +tests: +- name: Azure Runbook Webhook Created + file: cloud/azure_runbook_webhook_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true From f0926a5372362a770bc3f38deed897be6b78bdc4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Aug 2022 23:40:54 -0400 Subject: [PATCH 12/23] update detections --- .../azure_automation_runbook_created.yml | 4 +- .../cloud/azure_runbook_webhook_created.yml | 56 +++++++++++++------ .../azure_runbook_webhook_created.test.yml | 8 +-- 3 files changed, 45 insertions(+), 23 deletions(-) diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml index 7f9f661c3b..363f2c0204 100644 --- a/detections/cloud/azure_automation_runbook_created.yml +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -8,9 +8,9 @@ datamodel: [] description: The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. Once adversaries have obtained privileged access to an Azure tenant, they may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. -search: ' `azure_audit operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded +search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded | dedup object - | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path` + | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path | `azure_automation_runbook_created_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category. diff --git a/detections/cloud/azure_runbook_webhook_created.yml b/detections/cloud/azure_runbook_webhook_created.yml index 3bce82ecb3..6bf2fe345b 100644 --- a/detections/cloud/azure_runbook_webhook_created.yml +++ b/detections/cloud/azure_runbook_webhook_created.yml @@ -6,42 +6,64 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: UPDATE_DESCRIPTION -search: '| UPDATE_SPL | `azure_runbook_webhook_created_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded + | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path + | `azure_runbook_webhook_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. + Specifically, this analytic leverages the Azure Activity log category. +known_false_positives: Administrators may legitimately create Azure Runbook Webhooks. Filter as needed. references: -- REFERENCE +- https://docs.microsoft.com/en-us/azure/automation/overview +- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types +- https://docs.microsoft.com/en-us/azure/automation/automation-webhooks?tabs=portal +- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html +- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ +- https://attack.mitre.org/techniques/T1078/004/ tags: analytic_story: - - UPDATE_STORY_NAME - asset_type: UPDATE asset_type + - Azure Active Directory Persistence + asset_type: Azure cis20: - CIS 3 - CIS 5 - CIS 16 - confidence: UPDATE value between 1-100 + confidence: 90 context: - - Update context + - Source:Cloud Data + - Stage:Persistence dataset: - - UPDATE_DATASET_URL - impact: UPDATE value between 1-100 + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity.log + impact: 70 kill_chain_phases: - Exploitation - message: UPDATE message + message: A new Azure Runbook Webhook $object$ was created by $caller$ mitre_attack_id: - - T100 + - T1078 + - T1078.004 nist: - DE.CM observable: - - name: UPDATE - type: UPDATE + - name: object + type: Other role: - - UPDATE + - Victim + - name: caller + type: User + role: + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - UPDATE - risk_score: UPDATE (impact * confidence)/100 + - _time + - operationName.localizedValue + - status.value + - object + - caller + - claims.ipaddr + - resourceGroupName + - object_path + risk_score: 63 security_domain: threat diff --git a/tests/cloud/azure_runbook_webhook_created.test.yml b/tests/cloud/azure_runbook_webhook_created.test.yml index 92f73b4b4a..cae56c959d 100644 --- a/tests/cloud/azure_runbook_webhook_created.test.yml +++ b/tests/cloud/azure_runbook_webhook_created.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE + - file_name: azure-activity.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity.log + source: mscs:azure:audit + sourcetype: mscs:azure:audit update_timestamp: true From 779ec07f0e94c6bbf87fafa9f9bac3f4be166ff3 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 24 Aug 2022 11:13:03 -0400 Subject: [PATCH 13/23] adding description. updating dataset url --- detections/cloud/azure_automation_runbook_created.yml | 2 +- detections/cloud/azure_runbook_webhook_created.yml | 6 +++++- tests/cloud/azure_automation_runbook_created.test.yml | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml index 363f2c0204..9c5974b9c2 100644 --- a/detections/cloud/azure_automation_runbook_created.yml +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -36,7 +36,7 @@ tags: - Source:Cloud Data - Stage:Persistence dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques//T1078.004/azure_automation_runbook/azure-activity.log impact: 70 kill_chain_phases: - Installation diff --git a/detections/cloud/azure_runbook_webhook_created.yml b/detections/cloud/azure_runbook_webhook_created.yml index 6bf2fe345b..ba804d57b1 100644 --- a/detections/cloud/azure_runbook_webhook_created.yml +++ b/detections/cloud/azure_runbook_webhook_created.yml @@ -5,7 +5,11 @@ date: '2022-08-23' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows + administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. + One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet. + An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM. + This provides a persistent foothold on the environment. search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path | `azure_runbook_webhook_created_filter`' diff --git a/tests/cloud/azure_automation_runbook_created.test.yml b/tests/cloud/azure_automation_runbook_created.test.yml index e9a5a853fe..f290007034 100644 --- a/tests/cloud/azure_automation_runbook_created.test.yml +++ b/tests/cloud/azure_automation_runbook_created.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: azure-activity.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity.log source: mscs:azure:audit sourcetype: mscs:azure:audit update_timestamp: true From 0473b83ffb67bfc9f532d6f46206b16c9b691a9c Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 29 Aug 2022 12:12:42 -0400 Subject: [PATCH 14/23] minor fixes --- .../cloud/azure_ad_external_guest_user_invited.yml | 9 ++++++--- detections/cloud/azure_ad_service_principal_created.yml | 4 ++-- ...azure_ad_service_principal_new_client_credentials.yml | 1 + detections/cloud/azure_automation_account_created.yml | 2 +- detections/cloud/azure_automation_runbook_created.yml | 2 +- 5 files changed, 11 insertions(+), 7 deletions(-) diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml index 19d646b9ff..972109370c 100644 --- a/detections/cloud/azure_ad_external_guest_user_invited.yml +++ b/detections/cloud/azure_ad_external_guest_user_invited.yml @@ -5,9 +5,11 @@ date: '2022-08-18' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies the creation of a account for External Guest User through invitation. - With Azure AD B2B collaboration, you can invite anyone to collaborate with your organization using their own work, school, or social account. - Adversaries and red teams alike who have obtained administrative access may invite an External Guest User to establish Persistence and obtain single-factor access to an Azure AD environment. +description: 'The following analytic identifies the invitation of an external guest user within Azure AD. + With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. + External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. + An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External + Identities`' search: '`azuread` "body.operationName"="Invite external user" | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName @@ -20,6 +22,7 @@ how_to_implement: You must install the latest version of Splunk Add-on for Micro known_false_positives: Administrator may legitimately invite external guest users. Filter as needed. references: - https://dirkjanm.io/assets/raw/US-22-Mollema-Backdooring-and-hijacking-Azure-AD-accounts_final.pdf +- https://www.blackhat.com/us-22/briefings/schedule/#backdooring-and-hijacking-azure-ad-accounts-by-abusing-external-identities-26999 - https://attack.mitre.org/techniques/T1136/003/ - https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal tags: diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index 04b49f2fae..8a8befd613 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -6,8 +6,8 @@ author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic identifies the creation of a Service Principal in an Azure AD environment. - An Azure Service Principal is an identity designed for use with apps, services, and automated tools to access resources. Service Principal authentication does not support multi-factor authentication. - This access is restricted by the roles assigned to the Service Principal, giving users control over which resources can be accessed and at which level. + An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. + Service Principal authentication does not support multi-factor authentication. Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=* | rename body.properties.* as * diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml index bd1b84688d..e646b2d3cd 100644 --- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -23,6 +23,7 @@ references: - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/ - https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/ - https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html +- https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft tags: analytic_story: - Azure Active Directory Persistence diff --git a/detections/cloud/azure_automation_account_created.yml b/detections/cloud/azure_automation_account_created.yml index bc3638165c..f188527f50 100644 --- a/detections/cloud/azure_automation_account_created.yml +++ b/detections/cloud/azure_automation_account_created.yml @@ -8,7 +8,7 @@ datamodel: [] description: The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker. Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities. - Once adversaries have obtained privileged access to an Azure tenant, they may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. + Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation account" status.value=Succeeded | dedup object | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml index 9c5974b9c2..4d708b5f11 100644 --- a/detections/cloud/azure_automation_runbook_created.yml +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -7,7 +7,7 @@ type: TTP datamodel: [] description: The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. - Once adversaries have obtained privileged access to an Azure tenant, they may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. + Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded | dedup object | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path From 79f7f9c16e7aca19426ace2716bfb1f2949e9b94 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 29 Aug 2022 17:00:05 -0400 Subject: [PATCH 15/23] adding new detection --- ..._ad_global_administrator_role_assigned.yml | 3 +- .../azure_ad_privileged_role_assigned.yml | 72 +++++++++++++++++++ .../azure_ad_service_principal_created.yml | 2 +- lookups/privileged_azure_ad_roles.csv | 28 ++++++++ lookups/privileged_azure_ad_roles.yml | 7 ++ ...azure_ad_privileged_role_assigned.test.yml | 13 ++++ 6 files changed, 122 insertions(+), 3 deletions(-) create mode 100644 detections/cloud/azure_ad_privileged_role_assigned.yml create mode 100644 lookups/privileged_azure_ad_roles.csv create mode 100644 lookups/privileged_azure_ad_roles.yml create mode 100644 tests/cloud/azure_ad_privileged_role_assigned.test.yml diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml index 90ea739616..a1758b24ce 100644 --- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -13,8 +13,7 @@ search: '`azuread` "body.operationName"="Add member to role" "body.properties.t | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy - | rename targetResources{}.type as type - | stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName + | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName | `azure_ad_global_administrator_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category. diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml new file mode 100644 index 0000000000..fcfccacc2b --- /dev/null +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -0,0 +1,72 @@ +name: Azure AD Privileged Role Assigned +id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a +version: 1 +date: '2022-08-29' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. + Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment. +search: ' `azuread` "body.operationName"="Add member to role" + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.modifiedProperties{}.newValue as roles + | eval role=mvindex(roles,1) + | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True + | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description + | `azure_ad_privileged_role_assigned_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roles +- https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference +- https://adsecurity.org/?p=4277 +- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors +- https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning +- https://attack.mitre.org/techniques/T1098/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log + impact: 70 + kill_chain_phases: + - Installation + message: A privileged Azure AD role was assigned for User $userPrincipalName$ initiated by $initiatedBy$ + mitre_attack_id: + - T1098 + - T1098.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.targetResources{}.userPrincipalName + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 63 + security_domain: audit diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index 8a8befd613..04525cb57d 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -7,7 +7,7 @@ type: TTP datamodel: [] description: The following analytic identifies the creation of a Service Principal in an Azure AD environment. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. - Service Principal authentication does not support multi-factor authentication. + Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=* | rename body.properties.* as * diff --git a/lookups/privileged_azure_ad_roles.csv b/lookups/privileged_azure_ad_roles.csv new file mode 100644 index 0000000000..cfc5337f73 --- /dev/null +++ b/lookups/privileged_azure_ad_roles.csv @@ -0,0 +1,28 @@ +azureadrole,isprvilegedadrole,description +"""Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps. +"""Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user. +"""Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials. +"""Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices. +"""Azure DevOps Administrator""",True,Can manage Azure DevOps policies and settings. +"""Azure Information Protection Administrator""",True,Can manage all aspects of the Azure Information Protection product. +"""Cloud Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps except App Proxy. +"""Cloud Device Administrator""",True,Limited access to manage devices in Azure AD. +"""Compliance Administrator""",True,Can read and manage compliance configuration and reports in Azure AD and Microsoft 365. +"""Conditional Access Administrator""",True,Can manage Conditional Access capabilities. +"""Exchange Administrator""",True,Can manage all aspects of the Exchange product. +"""External Identity Provider Administrator""",True,Can configure identity providers for use in direct federation. +"""Groups Administrator""",True,Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports. +"""Helpdesk Administrator""",True,Can reset passwords for non-administrators and Helpdesk Administrators. +"""Intune Administrator""",True,Can manage all aspects of the Intune product. +"""License Administrator""",True,Can manage product licenses on users and groups. +"""Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications. +"""Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators. +"""Privileged Authentication Administrator""",True,Can access to view, set and reset authentication method information for any user (admin or non-admin). +"""Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management. +"""Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365. +"""SharePoint Administrator""",True,Can manage all aspects of the SharePoint service. +"""Teams Administrator""",True,Can manage the Microsoft Teams service. +"""User Administrator""",True,Can manage all aspects of users and groups, including resetting passwords for limited admins. +"""Windows 365 Administrator""",True,Can provision and manage all aspects of Cloud PCs. + + diff --git a/lookups/privileged_azure_ad_roles.yml b/lookups/privileged_azure_ad_roles.yml new file mode 100644 index 0000000000..6a2780ece8 --- /dev/null +++ b/lookups/privileged_azure_ad_roles.yml @@ -0,0 +1,7 @@ +description: A list of privileged Azure Active Directory roles. +filename: privileged_azure_ad_roles.csv +name: privileged_azuread_roles +default_match: 'false' +match_type: WILDCARD(azureadrole) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file diff --git a/tests/cloud/azure_ad_privileged_role_assigned.test.yml b/tests/cloud/azure_ad_privileged_role_assigned.test.yml new file mode 100644 index 0000000000..79b8b4e37f --- /dev/null +++ b/tests/cloud/azure_ad_privileged_role_assigned.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Privileged Role Assigned Unit Test +tests: +- name: Azure AD Privileged Role Assigned + file: cloud/azure_ad_privileged_role_assigned.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 6e07f25d0be41f7a117e5eeaac05473309f7acab Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 29 Aug 2022 17:30:34 -0400 Subject: [PATCH 16/23] fixing lookup name typo --- lookups/privileged_azure_ad_roles.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lookups/privileged_azure_ad_roles.yml b/lookups/privileged_azure_ad_roles.yml index 6a2780ece8..cc8e2df2ad 100644 --- a/lookups/privileged_azure_ad_roles.yml +++ b/lookups/privileged_azure_ad_roles.yml @@ -1,6 +1,6 @@ description: A list of privileged Azure Active Directory roles. filename: privileged_azure_ad_roles.csv -name: privileged_azuread_roles +name: privileged_azure_ad_roles default_match: 'false' match_type: WILDCARD(azureadrole) min_matches: 1 From 927d46a74ecea7f2e5c2cb7bf48c623a6f2460a1 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 30 Aug 2022 13:07:41 -0400 Subject: [PATCH 17/23] adding new detection --- ...ure_ad_user_enabled_and_password_reset.yml | 65 +++++++++++++++++++ ...d_user_enabled_and_password_reset.test.yml | 13 ++++ 2 files changed, 78 insertions(+) create mode 100644 detections/cloud/azure_ad_user_enabled_and_password_reset.yml create mode 100644 tests/cloud/azure_ad_user_enabled_and_password_reset.test.yml diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml new file mode 100644 index 0000000000..aeda4f8caf --- /dev/null +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -0,0 +1,65 @@ +name: Azure AD User Enabled And Password Reset +id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268 +version: 1 +date: '2022-08-29' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This behavior could represent + an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant.' +search: ' `azuread` (body.operationName="Enable account" OR body.operationName="Reset password (by admin)" OR body.operationName="Update user") + | transaction body.properties.targetResources{}.userPrincipalName startsWith=(body.operationName="Enable account") endsWith=(body.operationName="Reset password (by admin)") maxspan=2m + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | stats values(body.operationName) values(initiatedBy) by _time, userPrincipalName, result + | `azure_ad_user_enabled_and_password_reset_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: While not common, Administrators may enable accounts and reset their passwords for legitimate reasons. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1098/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_enable_and_reset/azure-audit.log + impact: 50 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A user account, $displayName$, was enabled and its password reset within 2 minutes by $initiatedBy$ + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: displayName + type: Other + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.operationName + - body.properties.targetResources{}.userPrincipalName + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 45 + security_domain: identity diff --git a/tests/cloud/azure_ad_user_enabled_and_password_reset.test.yml b/tests/cloud/azure_ad_user_enabled_and_password_reset.test.yml new file mode 100644 index 0000000000..b383797af3 --- /dev/null +++ b/tests/cloud/azure_ad_user_enabled_and_password_reset.test.yml @@ -0,0 +1,13 @@ +name: Azure AD User Enabled And Password Reset Unit Test +tests: +- name: Azure AD User Enabled And Password Reset + file: cloud/azure_ad_user_enabled_and_password_reset.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_enable_and_reset/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 9e94c62a6accb4d17dbc739a195ef2c28b99533d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 30 Aug 2022 18:25:25 -0400 Subject: [PATCH 18/23] adding new detection --- ...azure_ad_service_principal_owner_added.yml | 70 +++++++++++++++++++ ..._ad_service_principal_owner_added.test.yml | 13 ++++ 2 files changed, 83 insertions(+) create mode 100644 detections/cloud/azure_ad_service_principal_owner_added.yml create mode 100644 tests/cloud/azure_ad_service_principal_owner_added.test.yml diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml new file mode 100644 index 0000000000..3bca51d651 --- /dev/null +++ b/detections/cloud/azure_ad_service_principal_owner_added.yml @@ -0,0 +1,70 @@ +name: Azure AD Service Principal Owner Added +id: 7ddf2084-6cf3-4a44-be83-474f7b73c701 +version: 1 +date: '2022-08-30' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. + An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. + Service Principal authentication does not support multi-factor authentication nor conditional access policies. + Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. +search: ' `azuread` body.operationName="Add owner to application" + | rename body.properties.* as * + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.userPrincipalName as newOwner + | rename targetResources{}.modifiedProperties{}.newValue as displayName + | eval displayName = mvindex(displayName,1) + | where initiatedBy!=newOwner + | stats values(displayName) by _time, initiatedBy, result, body.operationName, newOwner + | `azure_ad_service_principal_owner_added_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrator may legitimately add new owners for Service Principals. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1098/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit.log + impact: 60 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new owner was added for service principal $displayName$ by $initiatedBy$ + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: displayName + type: Other + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.operationName + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.targetResources{}.userPrincipalName + - body.properties.targetResources{}.modifiedProperties{}.newValue + - body.propertiesresult + risk_score: 54 + security_domain: audit diff --git a/tests/cloud/azure_ad_service_principal_owner_added.test.yml b/tests/cloud/azure_ad_service_principal_owner_added.test.yml new file mode 100644 index 0000000000..2ac9d93d67 --- /dev/null +++ b/tests/cloud/azure_ad_service_principal_owner_added.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Service Principal Owner Added Unit Test +tests: +- name: Azure AD Service Principal Owner Added + file: cloud/azure_ad_service_principal_owner_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 441a1542bdb37d884bcb72e746175aebbcecde14 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 2 Sep 2022 18:03:14 -0400 Subject: [PATCH 19/23] adding new detection. fixing types. adding line to lookup --- .../azure_ad_new_federated_domain_added.yml | 65 +++++++++++++++++++ lookups/privileged_azure_ad_roles.csv | 1 + .../azure_active_directory_persistence.yml | 2 +- ...ure_ad_new_federated_domain_added.test.yml | 14 ++++ 4 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_ad_new_federated_domain_added.yml create mode 100644 tests/cloud/azure_ad_new_federated_domain_added.test.yml diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml new file mode 100644 index 0000000000..82798a5d8d --- /dev/null +++ b/detections/cloud/azure_ad_new_federated_domain_added.yml @@ -0,0 +1,65 @@ +name: Azure AD New Federated Domain Added +id: a87cd633-076d-4ab2-9047-977751a3c1a0 +version: 1 +date: '2022-09-02' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies. +search: ' `azuread` body.operationName="Set domain authentication" "body.properties.result"=success + | rename body.properties.* as * + | rename body.callerIpAddress as callerIpAddress + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.displayName as domain + | stats values(domain) by _time, initiatedBy, result, body.operationName + | `azure_ad_new_federated_domain_added_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: In most organizations, domain federation settings will be updated infrequently. Filter as needed. +references: +- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452 +- https://o365blog.com/post/federation-vulnerability/ +- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html +- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log + impact: 90 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new federated domain, $domain$ , was added by $initiatedBy$ + mitre_attack_id: + - T1484 + - T1484.002 + nist: + - DE.CM + observable: + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.operationName + - body.properties.result + - body.callerIpAddress + - body.properties.targetResources{}.displayName + - body.properties.initiatedBy.user.userPrincipalName + risk_score: 81 + security_domain: threat diff --git a/lookups/privileged_azure_ad_roles.csv b/lookups/privileged_azure_ad_roles.csv index cfc5337f73..877df539cd 100644 --- a/lookups/privileged_azure_ad_roles.csv +++ b/lookups/privileged_azure_ad_roles.csv @@ -13,6 +13,7 @@ azureadrole,isprvilegedadrole,description """External Identity Provider Administrator""",True,Can configure identity providers for use in direct federation. """Groups Administrator""",True,Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports. """Helpdesk Administrator""",True,Can reset passwords for non-administrators and Helpdesk Administrators. +"""Hybrid Identity Administrator""",True,Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings. """Intune Administrator""",True,Can manage all aspects of the Intune product. """License Administrator""",True,Can manage product licenses on users and groups. """Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications. diff --git a/stories/azure_active_directory_persistence.yml b/stories/azure_active_directory_persistence.yml index 9bf08fe735..bdaef2f073 100644 --- a/stories/azure_active_directory_persistence.yml +++ b/stories/azure_active_directory_persistence.yml @@ -9,7 +9,7 @@ narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-bas services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. - This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory accounts. + This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants. ' references: - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis diff --git a/tests/cloud/azure_ad_new_federated_domain_added.test.yml b/tests/cloud/azure_ad_new_federated_domain_added.test.yml new file mode 100644 index 0000000000..73770670ed --- /dev/null +++ b/tests/cloud/azure_ad_new_federated_domain_added.test.yml @@ -0,0 +1,14 @@ +name: Azure AD New Federated Domain Added Unit Test +tests: +- name: Azure AD New Federated Domain Added + file: cloud/azure_ad_new_federated_domain_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true + From 3d308b862fba95e036ffe1b8e0039989fc2a0054 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 2 Sep 2022 18:25:34 -0400 Subject: [PATCH 20/23] adding new detection --- .../azure_ad_new_custom_domain_added.yml | 67 +++++++++++++++++++ .../azure_ad_new_federated_domain_added.yml | 5 +- .../azure_ad_new_custom_domain_added.test.yml | 14 ++++ 3 files changed, 84 insertions(+), 2 deletions(-) create mode 100644 detections/cloud/azure_ad_new_custom_domain_added.yml create mode 100644 tests/cloud/azure_ad_new_custom_domain_added.test.yml diff --git a/detections/cloud/azure_ad_new_custom_domain_added.yml b/detections/cloud/azure_ad_new_custom_domain_added.yml new file mode 100644 index 0000000000..8b989223c3 --- /dev/null +++ b/detections/cloud/azure_ad_new_custom_domain_added.yml @@ -0,0 +1,67 @@ +name: Azure AD New Custom Domain Added +id: 30c47f45-dd6a-4720-9963-0bca6c8686ef +version: 1 +date: '2022-09-02' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies. +search: ' `azuread` body.operationName="Add unverified domain" "body.properties.result"=success + | rename body.properties.* as * + | rename body.callerIpAddress as callerIpAddress + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.displayName as domain + | stats values(domain) by _time, initiatedBy, result, body.operationName, callerIpAddress + | `azure_ad_new_custom_domain_added_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: In most organizations, new customm domains will be updated infrequently. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-manage +- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452 +- https://o365blog.com/post/federation-vulnerability/ +- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html +- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors +- https://attack.mitre.org/techniques/T1484/002/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log + impact: 60 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new custom domain, $domain$ , was added by $initiatedBy$ + mitre_attack_id: + - T1484 + - T1484.002 + nist: + - DE.CM + observable: + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.operationName + - body.properties.result + - body.callerIpAddress + - body.properties.targetResources{}.displayName + - body.properties.initiatedBy.user.userPrincipalName + risk_score: 54 + security_domain: threat diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml index 82798a5d8d..3ae29987fe 100644 --- a/detections/cloud/azure_ad_new_federated_domain_added.yml +++ b/detections/cloud/azure_ad_new_federated_domain_added.yml @@ -11,7 +11,7 @@ search: ' `azuread` body.operationName="Set domain authentication" "body.propert | rename body.callerIpAddress as callerIpAddress | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName as domain - | stats values(domain) by _time, initiatedBy, result, body.operationName + | stats values(domain) by _time, initiatedBy, result, body.operationName, callerIpAddress | `azure_ad_new_federated_domain_added_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category. @@ -21,6 +21,7 @@ references: - https://o365blog.com/post/federation-vulnerability/ - https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors +- https://attack.mitre.org/techniques/T1484/002/ tags: analytic_story: - Azure Active Directory Persistence @@ -32,7 +33,7 @@ tags: confidence: 90 context: - Source:Cloud Data - - Stage:Initial Access + - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log impact: 90 diff --git a/tests/cloud/azure_ad_new_custom_domain_added.test.yml b/tests/cloud/azure_ad_new_custom_domain_added.test.yml new file mode 100644 index 0000000000..60d0bd5a87 --- /dev/null +++ b/tests/cloud/azure_ad_new_custom_domain_added.test.yml @@ -0,0 +1,14 @@ +name: Azure AD New Custom Domain Added Unit Test +tests: +- name: Azure AD New Custom Domain Added + file: cloud/azure_ad_new_custom_domain_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true + From d8cce69644d86bcb4c9d0fbe2bc6cd465dbcd550 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 6 Sep 2022 16:08:35 -0400 Subject: [PATCH 21/23] adding new detection --- ..._ad_user_immutableid_attribute_updated.yml | 66 +++++++++++++++++++ ...ser_immutableid_attribute_updated.test.yml | 13 ++++ 2 files changed, 79 insertions(+) create mode 100644 detections/cloud/azure_ad_user_immutableid_attribute_updated.yml create mode 100644 tests/cloud/azure_ad_user_immutableid_attribute_updated.test.yml diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml new file mode 100644 index 0000000000..07d456d9ac --- /dev/null +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -0,0 +1,66 @@ +name: Azure AD User ImmutableId Attribute Updated +id: 0c0badad-4536-4a84-a561-5ff760f3c00e +version: 1 +date: '2022-09-02' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic. +search: ' `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename body.callerIpAddress as callerIpAddress + | rename targetResources{}.modifiedProperties{}.newValue as modifiedProperties + | stats values(userPrincipalName) values(modifiedProperties) by _time, initiatedBy, callerIpAddress, result, body.operationName + | `azure_ad_user_immutableid_attribute_updated_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-design-concepts +- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452 +- https://o365blog.com/post/federation-vulnerability/ +- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html +- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors +- https://attack.mitre.org/techniques/T1098/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit.log + impact: 50 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + risk_score: 45 + security_domain: threat diff --git a/tests/cloud/azure_ad_user_immutableid_attribute_updated.test.yml b/tests/cloud/azure_ad_user_immutableid_attribute_updated.test.yml new file mode 100644 index 0000000000..187516e21c --- /dev/null +++ b/tests/cloud/azure_ad_user_immutableid_attribute_updated.test.yml @@ -0,0 +1,13 @@ +name: Azure AD User ImmutableId Attribute Updated Unit Test +tests: +- name: Azure AD User ImmutableId Attribute Updated + file: cloud/azure_ad_user_immutableid_attribute_updated.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From d81df080b610755cb8a79427e8f4bd8c73f8f586 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 6 Sep 2022 17:26:06 -0400 Subject: [PATCH 22/23] updating descriptions --- detections/cloud/azure_ad_new_custom_domain_added.yml | 4 +++- detections/cloud/azure_ad_new_federated_domain_added.yml | 4 +++- .../cloud/azure_ad_user_immutableid_attribute_updated.yml | 8 +++++--- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/detections/cloud/azure_ad_new_custom_domain_added.yml b/detections/cloud/azure_ad_new_custom_domain_added.yml index 8b989223c3..fe44b42841 100644 --- a/detections/cloud/azure_ad_new_custom_domain_added.yml +++ b/detections/cloud/azure_ad_new_custom_domain_added.yml @@ -5,7 +5,9 @@ date: '2022-09-02' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies. +description: The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain + is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. An adversary who has obtained + privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to access Azure AD resources impersonating any user. search: ' `azuread` body.operationName="Add unverified domain" "body.properties.result"=success | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml index 3ae29987fe..bbbf6c783b 100644 --- a/detections/cloud/azure_ad_new_federated_domain_added.yml +++ b/detections/cloud/azure_ad_new_federated_domain_added.yml @@ -5,7 +5,9 @@ date: '2022-09-02' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies. +description: The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution + of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. An adversary who has obtained + privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to access Azure AD resources impersonating any user. search: ' `azuread` body.operationName="Set domain authentication" "body.properties.result"=success | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml index 07d456d9ac..04572e6006 100644 --- a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -5,7 +5,9 @@ date: '2022-09-02' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic. +description: The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute + is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. An adversary who has obtained + privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to access Azure AD resources impersonating any user. search: ' `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName @@ -16,7 +18,7 @@ search: ' `azuread` body.operationName="Update user" body.properties.targetResou | `azure_ad_user_immutableid_attribute_updated_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: The SourceAnchor (also called ImmutableId) Azure AD attribute has legitimate uses for directory synchronization. Investigate and filter as needed. references: - https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-design-concepts - https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452 @@ -42,7 +44,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: The SourceAnchor or ImmutableID attribute has been modified for user $userPrincipalName$ by $initiatedBy$ mitre_attack_id: - T1098 nist: From 4810926509a80ffdffda1d36dd4975aba4c52e05 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 6 Sep 2022 18:08:16 -0400 Subject: [PATCH 23/23] enhancing descriptions --- detections/cloud/azure_ad_new_custom_domain_added.yml | 10 +++++++--- .../cloud/azure_ad_new_federated_domain_added.yml | 10 +++++++--- .../azure_ad_user_immutableid_attribute_updated.yml | 10 +++++++--- 3 files changed, 21 insertions(+), 9 deletions(-) diff --git a/detections/cloud/azure_ad_new_custom_domain_added.yml b/detections/cloud/azure_ad_new_custom_domain_added.yml index fe44b42841..85e686e262 100644 --- a/detections/cloud/azure_ad_new_custom_domain_added.yml +++ b/detections/cloud/azure_ad_new_custom_domain_added.yml @@ -6,8 +6,12 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain - is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. An adversary who has obtained - privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to access Azure AD resources impersonating any user. + is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. + Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a + single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for + email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, + the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique + to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. search: ' `azuread` body.operationName="Add unverified domain" "body.properties.result"=success | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress @@ -20,7 +24,7 @@ how_to_implement: You must install the latest version of Splunk Add-on for Micro known_false_positives: In most organizations, new customm domains will be updated infrequently. Filter as needed. references: - https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-manage -- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452 +- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13 - https://o365blog.com/post/federation-vulnerability/ - https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml index bbbf6c783b..d95c1650b5 100644 --- a/detections/cloud/azure_ad_new_federated_domain_added.yml +++ b/detections/cloud/azure_ad_new_federated_domain_added.yml @@ -6,8 +6,12 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution - of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. An adversary who has obtained - privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to access Azure AD resources impersonating any user. + of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. + Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a + single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for + email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, + the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique + to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. search: ' `azuread` body.operationName="Set domain authentication" "body.properties.result"=success | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress @@ -19,7 +23,7 @@ how_to_implement: You must install the latest version of Splunk Add-on for Micro Specifically, this analytic leverages the AuditLogs log category. known_false_positives: In most organizations, domain federation settings will be updated infrequently. Filter as needed. references: -- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452 +- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13 - https://o365blog.com/post/federation-vulnerability/ - https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml index 04572e6006..77f228ca80 100644 --- a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -6,8 +6,12 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute - is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. An adversary who has obtained - privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to access Azure AD resources impersonating any user. + is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. + Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a + single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for + email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, + the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique + to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. search: ' `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName @@ -21,7 +25,7 @@ how_to_implement: You must install the latest version of Splunk Add-on for Micro known_false_positives: The SourceAnchor (also called ImmutableId) Azure AD attribute has legitimate uses for directory synchronization. Investigate and filter as needed. references: - https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-design-concepts -- https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452 +- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13 - https://o365blog.com/post/federation-vulnerability/ - https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors