From 63f87f5a12b265c2fbf16f12f5684beff1ca16cf Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 23 Aug 2022 16:28:55 -0400 Subject: [PATCH] adding new detection --- .../azure_automation_account_created.yml | 2 +- .../azure_automation_runbook_created.yml | 73 +++++++++++++++++++ .../azure_automation_runbook_created.test.yml | 13 ++++ 3 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_automation_runbook_created.yml create mode 100644 tests/cloud/azure_automation_runbook_created.test.yml diff --git a/detections/cloud/azure_automation_account_created.yml b/detections/cloud/azure_automation_account_created.yml index 69460abb27..bc3638165c 100644 --- a/detections/cloud/azure_automation_account_created.yml +++ b/detections/cloud/azure_automation_account_created.yml @@ -14,7 +14,7 @@ search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path | `azure_automation_account_created_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. - Specifically, this analytic leverages the AuditLogs log category. + Specifically, this analytic leverages the Azure Activity log category. known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed. references: - https://docs.microsoft.com/en-us/azure/automation/overview diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml new file mode 100644 index 0000000000..346e9d3a1e --- /dev/null +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -0,0 +1,73 @@ +name: Azure Automation Runbook Created +id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b +version: 1 +date: '2022-08-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows + administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. + Once adversaries have obtained privileged access to an Azure tenant, they may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. +search: ' `azure_audit index=main operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded + | dedup object + | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path` + | `azure_automation_runbook_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. + Specifically, this analytic leverages the Azure Activity log category. +known_false_positives: Administrators may legitimately create Azure Automation Runbooks. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/automation/overview +- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types +- https://docs.microsoft.com/en-us/azure/automation/manage-runbooks +- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html +- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ +- https://attack.mitre.org/techniques/T1136/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log + impact: 70 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new Azure Automation Runbook $object$ was created by $caller$ + mitre_attack_id: + - T1136 + - T1136.003 + nist: + - DE.CM + observable: + - name: object + type: Other + role: + - Victim + - name: caller + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - operationName.localizedValue + - status.value + - object + - caller + - claims.ipaddr + - resourceGroupName + - object_path + risk_score: 63 + security_domain: audit diff --git a/tests/cloud/azure_automation_runbook_created.test.yml b/tests/cloud/azure_automation_runbook_created.test.yml new file mode 100644 index 0000000000..e9a5a853fe --- /dev/null +++ b/tests/cloud/azure_automation_runbook_created.test.yml @@ -0,0 +1,13 @@ +name: Azure Automation Runbook Created Unit Test +tests: +- name: Azure Automation Runbook Created + file: cloud/azure_automation_runbook_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-activity.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_runbook/azure-activity.log + source: mscs:azure:audit + sourcetype: mscs:azure:audit + update_timestamp: true