From 2a0c7a69d1e2f26602e57a001bbf7a29f475b9bc Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 25 Aug 2022 16:02:54 -0400 Subject: [PATCH 1/3] adding new detection --- ...entication_failed_during_mfa_challenge.yml | 3 +- ..._multiple_failed_mfa_requests_for_user.yml | 71 +++++++++++++++++++ ...iple_failed_mfa_requests_for_user.test.yml | 13 ++++ 3 files changed, 85 insertions(+), 2 deletions(-) create mode 100644 detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml create mode 100644 tests/cloud/azure_ad_multiple_failed_mfa_requests_for_user.test.yml diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index e53f414612..3a3ae1cf8b 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -6,8 +6,7 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary - trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, - and phone calls, potentially resulting in the user finally accepting the authentication request.' + trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. ' search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml new file mode 100644 index 0000000000..b817e1d741 --- /dev/null +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -0,0 +1,71 @@ +name: Azure AD Multiple Failed MFA Requests For User +id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea +version: 1 +date: '2022-08-25' +author: Mauricio Velazco, Splunk +type: Anomaly +datamodel: [] +description: 'The following analytic identifies multiple failed multi-factor authentication requests for a user within an Azure AD tenant. Specifically, the analytic looks for more than 10 MFA requests. + This behavior may represent an adversary who has obtained legitimate credentials for a legitimate user and continuously repeat login attempts in order to bombard users with MFA push notifications + potentially resulting in the user finally accepting the authentication request. + Threat actors like the Lapsus team and APT29 leverage this technique to bypass mult-factor authentication controls as reported by Mandiant and others.' +search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 + | rename body.properties.* as * + | stats dc(_time) AS unique_accounts values(userPrincipalName) by userPrincipalName, ipAddress, status.additionalDetails, appDisplayName, userAgent + | `azure_ad_multiple_failed_mfa_requests_for_user_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed. +references: +- https://www.mandiant.com/resources/blog/russian-targeting-gov-business +- https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/ +- https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/ +- https://attack.mitre.org/techniques/T1621/ +- https://attack.mitre.org/techniques/T1078/004/ +tags: + analytic_story: + - Azure Active Directory Account Takeover + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit.log + impact: 70 + kill_chain_phases: + - Exploitation + message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$ + mitre_attack_id: + - T1621 + - T1078 + - T1078.004 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.status.errorCode + - body.category + - body.properties.authenticationDetails + - body.properties.userPrincipalName + - body.properties.ipAddress + risk_score: 63 + security_domain: identity diff --git a/tests/cloud/azure_ad_multiple_failed_mfa_requests_for_user.test.yml b/tests/cloud/azure_ad_multiple_failed_mfa_requests_for_user.test.yml new file mode 100644 index 0000000000..078005a185 --- /dev/null +++ b/tests/cloud/azure_ad_multiple_failed_mfa_requests_for_user.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Multiple Failed MFA Requests For User Unit Test +tests: +- name: Azure AD Multiple Failed MFA Requests For User + file: cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 02976117ce0db84cf9869765caf2bdc7f4547d12 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 29 Aug 2022 11:24:00 -0400 Subject: [PATCH 2/3] improving detection --- ...azure_ad_multiple_failed_mfa_requests_for_user.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index b817e1d741..96b9b59c16 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -5,13 +5,14 @@ date: '2022-08-25' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] -description: 'The following analytic identifies multiple failed multi-factor authentication requests for a user within an Azure AD tenant. Specifically, the analytic looks for more than 10 MFA requests. - This behavior may represent an adversary who has obtained legitimate credentials for a legitimate user and continuously repeat login attempts in order to bombard users with MFA push notifications - potentially resulting in the user finally accepting the authentication request. - Threat actors like the Lapsus team and APT29 leverage this technique to bypass mult-factor authentication controls as reported by Mandiant and others.' +description: 'The following analytic identifies multiple failed multi-factor authentication requests for a user within an Azure AD tenant. Specifically, the analytic looks for more than 10 failed MFA user prompts. + This behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeat login attempts in order to bombard users with MFA push notifications + potentially resulting in the user finally accepting the authentication request. Security teams should test this detection and customize the arbitrary threshold when needed. + Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass mult-factor authentication controls as reported by Mandiant and others.' search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 | rename body.properties.* as * - | stats dc(_time) AS unique_accounts values(userPrincipalName) by userPrincipalName, ipAddress, status.additionalDetails, appDisplayName, userAgent + | stats dc(_time) AS mfa_prompts values(userPrincipalName) by userPrincipalName, ipAddress, status.additionalDetails, appDisplayName, userAgent + | where mfa_prompts > 10 | `azure_ad_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs From 024337cf6287271ab691caa2bb49da1c4320b6cb Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 29 Aug 2022 11:46:57 -0400 Subject: [PATCH 3/3] improving detections --- ...ad_authentication_failed_during_mfa_challenge.yml | 4 ++-- ...zure_ad_multiple_failed_mfa_requests_for_user.yml | 12 +++++++----- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index 3a3ae1cf8b..e2fd07a372 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -5,8 +5,8 @@ date: '2022-07-14' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary - trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. ' +description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. + Error Code 500121 represents a failed attempt to authenticate using a second factor. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. ' search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index 96b9b59c16..7ae55b0dd0 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -5,13 +5,15 @@ date: '2022-08-25' author: Mauricio Velazco, Splunk type: Anomaly datamodel: [] -description: 'The following analytic identifies multiple failed multi-factor authentication requests for a user within an Azure AD tenant. Specifically, the analytic looks for more than 10 failed MFA user prompts. - This behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeat login attempts in order to bombard users with MFA push notifications - potentially resulting in the user finally accepting the authentication request. Security teams should test this detection and customize the arbitrary threshold when needed. - Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass mult-factor authentication controls as reported by Mandiant and others.' +description: 'The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor. + Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. + The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls + potentially resulting in the user finally accepting the authentication request. + Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.' search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 | rename body.properties.* as * - | stats dc(_time) AS mfa_prompts values(userPrincipalName) by userPrincipalName, ipAddress, status.additionalDetails, appDisplayName, userAgent + | bucket span=10m _time + | stats dc(_raw) AS mfa_prompts values(userPrincipalName) by userPrincipalName, status.additionalDetails, appDisplayName, userAgent, _time | where mfa_prompts > 10 | `azure_ad_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).