mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
@@ -29,12 +29,12 @@ tags:
|
||||
asset_type: AWS Account
|
||||
confidence: 80
|
||||
impact: 80
|
||||
message: A new virtual device $virtualMFADeviceName$ is added to user $user_arn$
|
||||
message: A new virtual device $virtualMFADeviceName$ is added to user $user_arn$
|
||||
mitre_attack_id:
|
||||
- T1556
|
||||
- T1556.006
|
||||
observable:
|
||||
- name: user_name
|
||||
- name: user_arn
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure Active Directory High Risk Sign-in
|
||||
id: 1ecff169-26d7-4161-9a7b-2ac4c8e61bea
|
||||
version: 1
|
||||
date: '2022-07-11'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic triggers on a high risk sign-in against Azure
|
||||
@@ -10,13 +10,12 @@ description: The following analytic triggers on a high risk sign-in against Azur
|
||||
sign-in events using heuristics and machine learning to identify potentially malicious
|
||||
events and categorizes them in three categories high, medium and low.
|
||||
data_source: []
|
||||
search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high |
|
||||
rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress,
|
||||
search: ' `azuread` category=UserRiskEvents properties.riskLevel=high |
|
||||
rename properties.* as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress,
|
||||
activity, riskLevel, riskEventType, additionalInfo | `azure_active_directory_high_risk_sign_in_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events in your Splunk environment.
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category.
|
||||
known_false_positives: Details for the risk calculation algorithm used by Identity
|
||||
Protection are unknown and may be prone to false positives.
|
||||
@@ -31,7 +30,7 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 90
|
||||
impact: 60
|
||||
message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$
|
||||
message: A high risk event was identified by Identify Protection for user $userPrincipalName$
|
||||
mitre_attack_id:
|
||||
- T1586
|
||||
- T1586.003
|
||||
@@ -52,13 +51,13 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.category
|
||||
- body.properties.riskLevel
|
||||
- body.properties.userPrincipalName
|
||||
- body.properties.ipAddress
|
||||
- body.properties.activity
|
||||
- body.properties.riskEventType
|
||||
- body.properties.additionalInfo
|
||||
- category
|
||||
- properties.riskLevel
|
||||
- properties.userPrincipalName
|
||||
- properties.ipAddress
|
||||
- properties.activity
|
||||
- properties.riskEventType
|
||||
- properties.additionalInfo
|
||||
risk_score: 54
|
||||
security_domain: identity
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Application Administrator Role Assigned
|
||||
id: eac4de87-7a56-4538-a21b-277897af6d8d
|
||||
version: 1
|
||||
date: '2023-04-25'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
data_source: []
|
||||
@@ -12,11 +12,11 @@ description: The following analytic identifies the assignment of the Application
|
||||
been granted access to a resource, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while
|
||||
impersonating the application. This ability to impersonate the applications identity may be an elevation of privilege over what the user can do via their role assignments.
|
||||
Red teams and adversaries alike may abuse this role to escalate their privileges in an Azure AD tenant.
|
||||
search: ' `azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\""
|
||||
| rename body.properties.* as *
|
||||
search: ' `azuread` "operationName"="Add member to role" "properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\""
|
||||
| rename properties.* as *
|
||||
| rename targetResources{}.userPrincipalName as userPrincipalName
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy
|
||||
| stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
|
||||
| stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName
|
||||
| `azure_ad_application_administrator_role_assigned_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
@@ -57,10 +57,10 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.targetResources{}.userPrincipalName
|
||||
- body.properties.targetResources{}.type
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.result
|
||||
- properties.targetResources{}.userPrincipalName
|
||||
- properties.targetResources{}.type
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.result
|
||||
risk_score: 35
|
||||
security_domain: endpoint
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Authentication Failed During MFA Challenge
|
||||
id: e62c9c2e-bf51-4719-906c-3074618fcc1c
|
||||
version: 1
|
||||
date: '2022-07-14'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: 'The following analytic identifies an authentication attempt event against
|
||||
@@ -11,12 +11,12 @@ description: 'The following analytic identifies an authentication attempt event
|
||||
This behavior may represent an adversary trying to authenticate with compromised
|
||||
credentials for an account that has multi-factor authentication enabled. '
|
||||
data_source: []
|
||||
search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
|
||||
| rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress,
|
||||
search: ' `azuread` category=SignInLogs properties.status.errorCode=500121
|
||||
| rename properties.* as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress,
|
||||
status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events in your Splunk environment.
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: Legitimate users may miss to reply the MFA challenge within
|
||||
the time window or deny it by mistake.
|
||||
@@ -30,7 +30,7 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 90
|
||||
impact: 60
|
||||
message: User $body.properties.userPrincipalName$ failed to pass MFA challenge
|
||||
message: User $userPrincipalName$ failed to pass MFA challenge
|
||||
mitre_attack_id:
|
||||
- T1586
|
||||
- T1586.003
|
||||
@@ -52,13 +52,13 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.category
|
||||
- body.properties.status.errorCode
|
||||
- body.properties.userPrincipalName
|
||||
- body.properties.ipAddress
|
||||
- body.properties.status.additionalDetails
|
||||
- body.properties.appDisplayName
|
||||
- body.properties.userAgent
|
||||
- category
|
||||
- properties.status.errorCode
|
||||
- properties.userPrincipalName
|
||||
- properties.ipAddress
|
||||
- properties.status.additionalDetails
|
||||
- properties.appDisplayName
|
||||
- properties.userAgent
|
||||
risk_score: 54
|
||||
security_domain: identity
|
||||
tests:
|
||||
|
||||
@@ -14,11 +14,11 @@ description: The following analytic identifies an Azure AD account with concurre
|
||||
data_source: []
|
||||
search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs
|
||||
| rename properties.* as * | bucket span=5m _time | stats dc(ipAddress) AS unique_ips
|
||||
values(ipAddress) values(appDisplayName) by _time, userPrincipalName | where unique_ips
|
||||
values(ipAddress) as ipAddress values(appDisplayName) by _time, userPrincipalName | where unique_ips
|
||||
> 1 | `azure_ad_concurrent_sessions_from_different_ips_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: A user with concurrent sessions from different Ips may also
|
||||
represent the legitimate use of more than one device. Filter as needed and/or customize
|
||||
|
||||
@@ -13,10 +13,10 @@ description: The following analytic identifies the invitation of an external gue
|
||||
2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking
|
||||
Azure AD Accounts by Abusing External Identities`
|
||||
data_source: []
|
||||
search: '`azuread` "body.operationName"="Invite external user" | rename body.properties.*
|
||||
search: '`azuread` "operationName"="Invite external user" | rename properties.*
|
||||
as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename
|
||||
initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.type
|
||||
as type | stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName
|
||||
as type | stats values(userPrincipalName) as userPrincipalName by _time, type, initiatedBy, result, operationName
|
||||
| `azure_ad_external_guest_user_invited_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
@@ -53,10 +53,10 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.targetResources{}.userPrincipalName
|
||||
- body.properties.targetResources{}.type
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.result
|
||||
- properties.targetResources{}.userPrincipalName
|
||||
- properties.targetResources{}.type
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.result
|
||||
risk_score: 45
|
||||
security_domain: threat
|
||||
tests:
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
name: Azure AD Global Administrator Role Assigned
|
||||
id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
|
||||
version: 2
|
||||
version: 3
|
||||
date: '2022-08-17'
|
||||
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
|
||||
status: production
|
||||
@@ -14,14 +14,15 @@ description: The following analytic identifies the assignment of the Azure AD Gl
|
||||
to gain control of Azure resources. Adversaries and red teams alike may assign this
|
||||
role to a compromised account to establish Persistence or escalate their privileges in an Azure AD environment.
|
||||
data_source: []
|
||||
search: '`azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global
|
||||
Administrator\"" | rename body.properties.* as * | rename targetResources{}.userPrincipalName
|
||||
as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
|
||||
| stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
|
||||
search: '`azuread` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="\"Global Administrator\""
|
||||
| rename properties.* as *
|
||||
| rename targetResources{}.userPrincipalName as userPrincipalName
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy
|
||||
| stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName
|
||||
| `azure_ad_global_administrator_role_assigned_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the AuditLogs log category.
|
||||
known_false_positives: Administrators may legitimately assign the Global Administrator
|
||||
role to a user. Filter as needed.
|
||||
@@ -58,10 +59,10 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.targetResources{}.userPrincipalName
|
||||
- body.properties.targetResources{}.type
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.result
|
||||
- properties.targetResources{}.userPrincipalName
|
||||
- properties.targetResources{}.type
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.result
|
||||
risk_score: 72
|
||||
security_domain: threat
|
||||
tests:
|
||||
|
||||
@@ -15,7 +15,7 @@ search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 prope
|
||||
by userPrincipalName, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_for_user_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: A user with more than 20 failed authentication attempts in
|
||||
the span of 5 minutes may also be triggered by a broken application.
|
||||
|
||||
@@ -13,10 +13,10 @@ description: The following analytic identifies an Ip address failing to authenti
|
||||
data_source: []
|
||||
search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
|
||||
| rename properties.* as * | bucket span=5m _time | stats dc(_raw) AS failed_attempts
|
||||
values(userPrincipalName) by ipAddress, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_from_ip_filter`'
|
||||
values(userPrincipalName) as userPrincipalName by ipAddress, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_from_ip_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: An Ip address with more than 20 failed authentication attempts
|
||||
in the span of 5 minutes may also be triggered by a broken application.
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Multi-Factor Authentication Disabled
|
||||
id: 482dd42a-acfa-486b-a0bb-d6fcda27318e
|
||||
version: 1
|
||||
date: '2022-08-10'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies an attempt to disable multi-factor
|
||||
@@ -11,14 +11,14 @@ description: The following analytic identifies an attempt to disable multi-facto
|
||||
and maintain persistence using a valid account. This way the attackers can keep
|
||||
persistance in the environment without adding new users.
|
||||
data_source: []
|
||||
search: '`azuread` body.category=AuditLogs body.operationName="Disable Strong Authentication"
|
||||
| rename body.properties.* as * | rename targetResources{}.userPrincipalName as
|
||||
search: '`azuread` category=AuditLogs operationName="Disable Strong Authentication"
|
||||
| rename properties.* as * | rename targetResources{}.userPrincipalName as
|
||||
userPrincipalName | rename targetResources{}.type as type | rename initiatedBy.user.userPrincipalName
|
||||
as initiatedBy | stats values(userPrincipalName) by _time, type, body.operationName,
|
||||
as initiatedBy | stats values(userPrincipalName) as userPrincipalName by _time, type, operationName,
|
||||
initiatedBy, result | `azure_ad_multi_factor_authentication_disabled_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the AuditLogs log category.
|
||||
known_false_positives: Legitimate use case may require for users to disable MFA. Filter
|
||||
as needed.
|
||||
@@ -54,10 +54,10 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.targetResources{}.userPrincipalName
|
||||
- body.properties.targetResources{}.type
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.result
|
||||
- properties.targetResources{}.userPrincipalName
|
||||
- properties.targetResources{}.type
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.result
|
||||
risk_score: 45
|
||||
security_domain: identity
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Multiple Failed MFA Requests For User
|
||||
id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea
|
||||
version: 1
|
||||
date: '2022-08-25'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies multiple failed multi-factor authentication
|
||||
@@ -18,13 +18,13 @@ description: The following analytic identifies multiple failed multi-factor auth
|
||||
this technique to bypass multi-factor authentication controls as reported by Mandiant
|
||||
and others.
|
||||
data_source: []
|
||||
search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
|
||||
| rename body.properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts
|
||||
values(userPrincipalName) by userPrincipalName, status.additionalDetails, appDisplayName,
|
||||
search: ' `azuread` category=SignInLogs properties.status.errorCode=500121
|
||||
| rename properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts
|
||||
values(ipAddress) as ipAddress by userPrincipalName, status.additionalDetails, appDisplayName,
|
||||
userAgent, _time | where mfa_prompts > 10 | `azure_ad_multiple_failed_mfa_requests_for_user_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: Multiple Failed MFA requests may also be a sign of authentication
|
||||
or application issues. Filter as needed.
|
||||
@@ -40,7 +40,7 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 90
|
||||
impact: 60
|
||||
message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$
|
||||
message: Multiple Failed MFA requests for user $userPrincipalName$
|
||||
mitre_attack_id:
|
||||
- T1586
|
||||
- T1586.003
|
||||
@@ -62,11 +62,11 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.status.errorCode
|
||||
- body.category
|
||||
- body.properties.authenticationDetails
|
||||
- body.properties.userPrincipalName
|
||||
- body.properties.ipAddress
|
||||
- properties.status.errorCode
|
||||
- category
|
||||
- properties.authenticationDetails
|
||||
- properties.userPrincipalName
|
||||
- properties.ipAddress
|
||||
risk_score: 54
|
||||
security_domain: identity
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Multiple Users Failing To Authenticate From Ip
|
||||
id: 94481a6a-8f59-4c86-957f-55a71e3612a6
|
||||
version: 1
|
||||
date: '2022-07-12'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: Anomaly
|
||||
description: 'The following analytic identifies one source Ip failing to authenticate
|
||||
@@ -15,13 +15,15 @@ description: 'The following analytic identifies one source Ip failing to authent
|
||||
Azure AD tenants can be very different depending on the organization. Users should
|
||||
test this detection and customize the arbitrary threshold if needed.'
|
||||
data_source: []
|
||||
search: ' `azuread` body.category= SignInLogs body.properties.status.errorCode=50126
|
||||
body.properties.authenticationDetails{}.succeeded= false | rename body.properties.*
|
||||
as * | bucket span=5m _time | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName)
|
||||
as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
|
||||
search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
|
||||
| rename properties.* as *
|
||||
| bucket span=5m _time
|
||||
| stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as userPrincipalName by _time, ipAddress
|
||||
| where unique_accounts > 30
|
||||
| `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: A source Ip failing to authenticate with multiple users is
|
||||
not a common for legitimate behavior.
|
||||
@@ -36,7 +38,7 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 90
|
||||
impact: 70
|
||||
message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users
|
||||
message: Source Ip $ipAddress$ failed to authenticate with 30 users
|
||||
within 5 minutes.
|
||||
mitre_attack_id:
|
||||
- T1586
|
||||
@@ -59,17 +61,17 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.status.errorCode
|
||||
- body.category
|
||||
- body.properties.authenticationDetails
|
||||
- body.properties.userPrincipalName
|
||||
- body.properties.ipAddress
|
||||
- properties.status.errorCode
|
||||
- category
|
||||
- properties.authenticationDetails
|
||||
- properties.userPrincipalName
|
||||
- properties.ipAddress
|
||||
risk_score: 63
|
||||
security_domain: identity
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin.log
|
||||
source: mscs:azure:eventhub
|
||||
sourcetype: mscs:azure:eventhub
|
||||
update_timestamp: true
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD New Custom Domain Added
|
||||
id: 30c47f45-dd6a-4720-9963-0bca6c8686ef
|
||||
version: 1
|
||||
date: '2022-09-02'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies the addition of a new custom domain
|
||||
@@ -19,10 +19,10 @@ description: The following analytic identifies the addition of a new custom doma
|
||||
persistence and be able to authenticate to Azure AD impersonating any user and bypassing
|
||||
the requirement to have a valid password and/or perform MFA.
|
||||
data_source: []
|
||||
search: ' `azuread` body.operationName="Add unverified domain" "body.properties.result"=success
|
||||
| rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress
|
||||
search: ' `azuread` operationName="Add unverified domain" "properties.result"=success
|
||||
| rename properties.* as * | rename callerIpAddress as callerIpAddress
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName
|
||||
as domain | stats values(domain) by _time, initiatedBy, result, body.operationName,
|
||||
as domain | stats values(domain) by _time, initiatedBy, result, operationName,
|
||||
callerIpAddress | `azure_ad_new_custom_domain_added_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
@@ -58,11 +58,11 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.operationName
|
||||
- body.properties.result
|
||||
- body.callerIpAddress
|
||||
- body.properties.targetResources{}.displayName
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- operationName
|
||||
- properties.result
|
||||
- callerIpAddress
|
||||
- properties.targetResources{}.displayName
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
risk_score: 54
|
||||
security_domain: threat
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD New Federated Domain Added
|
||||
id: a87cd633-076d-4ab2-9047-977751a3c1a0
|
||||
version: 1
|
||||
date: '2022-09-02'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies the addition of a new federated domain
|
||||
@@ -19,10 +19,10 @@ description: The following analytic identifies the addition of a new federated d
|
||||
persistence and be able to authenticate to Azure AD impersonating any user and bypassing
|
||||
the requirement to have a valid password and/or perform MFA.
|
||||
data_source: []
|
||||
search: ' `azuread` body.operationName="Set domain authentication" "body.properties.result"=success
|
||||
| rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress
|
||||
search: ' `azuread` operationName="Set domain authentication" "properties.result"=success
|
||||
| rename properties.* as * | rename callerIpAddress as callerIpAddress
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName
|
||||
as domain | stats values(domain) by _time, initiatedBy, result, body.operationName,
|
||||
as domain | stats values(domain) by _time, initiatedBy, result, operationName,
|
||||
callerIpAddress | `azure_ad_new_federated_domain_added_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
@@ -57,11 +57,11 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.operationName
|
||||
- body.properties.result
|
||||
- body.callerIpAddress
|
||||
- body.properties.targetResources{}.displayName
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- operationName
|
||||
- properties.result
|
||||
- callerIpAddress
|
||||
- properties.targetResources{}.displayName
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
risk_score: 81
|
||||
security_domain: threat
|
||||
tests:
|
||||
|
||||
@@ -11,11 +11,11 @@ description: The following analytic identifies the registration of a new Multi F
|
||||
data_source: []
|
||||
search: ' `azuread` category=AuditLogs operationName="User registered security info"
|
||||
properties.operationType=Add | rename properties.* as * | rename targetResources{}.*
|
||||
as * | stats values(userPrincipalName) by _time, resultDescription, result, callerIpAddress
|
||||
as * | stats values(userPrincipalName) as userPrincipalName by _time, resultDescription, result, callerIpAddress
|
||||
| `azure_ad_new_mfa_method_registered_for_user_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the AuditLogs log category.
|
||||
known_false_positives: Newly onboarded users who are registering an MFA method for
|
||||
the first time will also trigger this detection.
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Privileged Authentication Administrator Role Assigned
|
||||
id: a7da845d-6fae-41cf-b823-6c0b8c55814a
|
||||
version: 1
|
||||
date: '2023-04-25'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
data_source: []
|
||||
@@ -10,11 +10,11 @@ description: The following analytic identifies the assignment of the Privileged
|
||||
methods for any user in Azure Active Directory, including privileged roles like Global Administrators. Users with this role can change credentials for people who may have access to sensitive
|
||||
or private information or critical configuration inside and outside of Azure Active Directory. Changing the credentials of a user may mean the ability to assume that users identity and permissions.
|
||||
Red teams and adversaries alike may abuse this role to escalate their privileges.
|
||||
search: ' `azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\""
|
||||
| rename body.properties.* as *
|
||||
search: ' `azuread` "operationName"="Add member to role" "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\""
|
||||
| rename properties.* as *
|
||||
| rename targetResources{}.userPrincipalName as userPrincipalName
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy
|
||||
| stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
|
||||
| stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName
|
||||
| `azure_ad_privileged_authentication_administrator_role_assigned_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
@@ -51,10 +51,10 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.targetResources{}.userPrincipalName
|
||||
- body.properties.targetResources{}.type
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.result
|
||||
- properties.targetResources{}.userPrincipalName
|
||||
- properties.targetResources{}.type
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.result
|
||||
risk_score: 50
|
||||
security_domain: identity
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Privileged Role Assigned
|
||||
id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a
|
||||
version: 1
|
||||
date: '2022-08-29'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies the assignment of sensitive and privileged
|
||||
@@ -10,14 +10,14 @@ description: The following analytic identifies the assignment of sensitive and p
|
||||
may assign these roles to a compromised account to establish Persistence in an Azure
|
||||
AD environment.
|
||||
data_source: []
|
||||
search: ' `azuread` "body.operationName"="Add member to role" | rename body.properties.* as *
|
||||
search: ' `azuread` "operationName"="Add member to role" | rename properties.* as *
|
||||
| rename targetResources{}.userPrincipalName as userPrincipalName
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy
|
||||
| rename targetResources{}.modifiedProperties{}.newValue as roles
|
||||
| eval role=mvindex(roles,1)
|
||||
| lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description
|
||||
| search isprvilegedadrole = True
|
||||
| stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description
|
||||
| stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName, role, description
|
||||
| `azure_ad_privileged_role_assigned_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
@@ -58,10 +58,10 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.targetResources{}.userPrincipalName
|
||||
- body.properties.targetResources{}.type
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.result
|
||||
- properties.targetResources{}.userPrincipalName
|
||||
- properties.targetResources{}.type
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.result
|
||||
risk_score: 63
|
||||
security_domain: audit
|
||||
tests:
|
||||
|
||||
@@ -14,14 +14,16 @@ description: The following analytic identifies the creation of a Service Princip
|
||||
access may create a Service Principal to establish Persistence and obtain single-factor
|
||||
access to an Azure AD environment.
|
||||
data_source: []
|
||||
search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=*
|
||||
| rename body.properties.* as * | rename targetResources{}.displayName as displayName
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.type
|
||||
as type | stats values(displayName) by _time, type, initiatedBy, result, body.operationName
|
||||
search: '`azuread` operationName="Add service principal" properties.initiatedBy.user.id=*
|
||||
| rename properties.* as *
|
||||
| rename targetResources{}.displayName as displayName
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy
|
||||
| rename targetResources{}.type as type
|
||||
| stats values(displayName) as displayName by _time, type, initiatedBy, result, operationName
|
||||
| `azure_ad_service_principal_created_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment thorough an EventHub.
|
||||
Specifically, this analytic leverages the AuditLogs log category.
|
||||
known_false_positives: Administrator may legitimately create Service Principal. Filter
|
||||
as needed.
|
||||
@@ -55,10 +57,10 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.targetResources{}.displayName
|
||||
- body.properties.targetResources{}.type
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.result
|
||||
- properties.targetResources{}.displayName
|
||||
- properties.targetResources{}.type
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.result
|
||||
risk_score: 45
|
||||
security_domain: threat
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Service Principal New Client Credentials
|
||||
id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a
|
||||
version: 2
|
||||
date: '2022-08-17'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies the addition of new credentials for Service
|
||||
@@ -16,9 +16,9 @@ description: The following analytic identifies the addition of new credentials f
|
||||
with privileged access, attackers may also escalate their privileges in an Azure AD environment by adding new credentials and
|
||||
logging in as the service principal.
|
||||
data_source: []
|
||||
search: ' `azuread` body.category=AuditLogs body.operationName="Update application*Certificates
|
||||
and secrets management " | rename body.* as * | rename properties.* as * | rename
|
||||
targetResources{}.* as * | stats values(displayName) by _time, initiatedBy.user.userPrincipalName,
|
||||
search: ' `azuread` category=AuditLogs operationName="Update application*Certificates
|
||||
and secrets management " | rename * as * | rename properties.* as * | rename
|
||||
targetResources{}.* as * | stats values(displayName) as displayName by _time, initiatedBy.user.userPrincipalName,
|
||||
modifiedProperties{}.newValue | `azure_ad_service_principal_new_client_credentials_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
@@ -40,7 +40,7 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 50
|
||||
impact: 70
|
||||
message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$
|
||||
message: New credentials added for Service Principal $properties.targetResources{}.displayName$
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
- T1098.001
|
||||
@@ -59,11 +59,11 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.category
|
||||
- body.operationName
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.targetResources{}.displayName
|
||||
- body.properties.targetResources{}.modifiedProperties{}.newValue
|
||||
- category
|
||||
- operationName
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.targetResources{}.displayName
|
||||
- properties.targetResources{}.modifiedProperties{}.newValue
|
||||
risk_score: 35
|
||||
security_domain: threat
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Service Principal Owner Added
|
||||
id: 7ddf2084-6cf3-4a44-be83-474f7b73c701
|
||||
version: 2
|
||||
date: '2022-08-30'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies the addition of a new owner for a Service
|
||||
@@ -15,15 +15,18 @@ description: The following analytic identifies the addition of a new owner for a
|
||||
and obtain single-factor access to an Azure AD environment. Attackers who are looking to
|
||||
escalate their privileges by leveraging a Service Principals permissions may also add a new owner.
|
||||
data_source: []
|
||||
search: ' `azuread` body.operationName="Add owner to application" | rename body.properties.*
|
||||
as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName
|
||||
as newOwner | rename targetResources{}.modifiedProperties{}.newValue as displayName
|
||||
| eval displayName = mvindex(displayName,1) | where initiatedBy!=newOwner | stats
|
||||
values(displayName) by _time, initiatedBy, result, body.operationName, newOwner
|
||||
search: ' `azuread` operationName="Add owner to application"
|
||||
| rename properties.* as *
|
||||
| rename initiatedBy.user.userPrincipalName as initiatedBy
|
||||
| rename targetResources{}.userPrincipalName as newOwner
|
||||
| rename targetResources{}.modifiedProperties{}.newValue as displayName
|
||||
| eval displayName = mvindex(displayName,1)
|
||||
| where initiatedBy!=newOwner
|
||||
| stats values(displayName) as displayName by _time, initiatedBy, result, operationName, newOwner
|
||||
| `azure_ad_service_principal_owner_added_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the AuditLogs log category.
|
||||
known_false_positives: Administrator may legitimately add new owners for Service Principals.
|
||||
Filter as needed.
|
||||
@@ -54,11 +57,11 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.operationName
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.targetResources{}.userPrincipalName
|
||||
- body.properties.targetResources{}.modifiedProperties{}.newValue
|
||||
- body.propertiesresult
|
||||
- operationName
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.targetResources{}.userPrincipalName
|
||||
- properties.targetResources{}.modifiedProperties{}.newValue
|
||||
- properties.result
|
||||
risk_score: 54
|
||||
security_domain: audit
|
||||
tests:
|
||||
|
||||
@@ -14,11 +14,11 @@ description: The following analytic identifies an Azure AD account successfully
|
||||
data_source: []
|
||||
search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=SignInLogs
|
||||
| rename properties.* as * | bucket span=5m _time | stats dc(ipAddress) AS unique_ips
|
||||
values(ipAddress) values(appDisplayName) by _time, userPrincipalName | where unique_ips
|
||||
values(ipAddress) as ipAddress values(appDisplayName) by _time, userPrincipalName | where unique_ips
|
||||
> 1 | `azure_ad_successful_authentication_from_different_ips_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: A user with successful authentication events from different
|
||||
Ips may also represent the legitimate use of more than one device. Filter as needed
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Successful PowerShell Authentication
|
||||
id: 62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
|
||||
version: 1
|
||||
date: '2022-07-13'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies a successful authentication event against
|
||||
@@ -11,13 +11,13 @@ description: The following analytic identifies a successful authentication event
|
||||
and red teams alike will perform enumeration and discovery techniques. One method
|
||||
of executing these techniques is leveraging the native PowerShell modules.
|
||||
data_source: []
|
||||
search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true
|
||||
body.properties.appDisplayName="Azure Active Directory PowerShell" | rename body.properties.*
|
||||
as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent
|
||||
search: ' `azuread` category=SignInLogs properties.authenticationDetails{}.succeeded=true
|
||||
properties.appDisplayName="Microsoft Azure PowerShell" | rename properties.*
|
||||
as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress, appDisplayName, userAgent
|
||||
| `azure_ad_successful_powershell_authentication_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events in your Splunk environment.
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: Administrative users will likely use PowerShell commandlets
|
||||
to troubleshoot and maintain the environment. Filter as needed.
|
||||
@@ -32,7 +32,7 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 90
|
||||
impact: 60
|
||||
message: Successful authentication for user $body.properties.userPrincipalName$
|
||||
message: Successful authentication for user $userPrincipalName$
|
||||
using PowerShell.
|
||||
mitre_attack_id:
|
||||
- T1586
|
||||
@@ -54,12 +54,12 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.appDisplayName
|
||||
- body.category
|
||||
- body.properties.userPrincipalName
|
||||
- body.properties.ipAddress
|
||||
- body.properties.appDisplayName
|
||||
- body.properties.userAgent
|
||||
- properties.appDisplayName
|
||||
- category
|
||||
- properties.userPrincipalName
|
||||
- properties.ipAddress
|
||||
- properties.appDisplayName
|
||||
- properties.userAgent
|
||||
risk_score: 54
|
||||
security_domain: identity
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD Successful Single-Factor Authentication
|
||||
id: a560e7f6-1711-4353-885b-40be53101fcd
|
||||
version: 1
|
||||
date: '2022-07-12'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies a successful authentication event against
|
||||
@@ -10,13 +10,13 @@ description: The following analytic identifies a successful authentication event
|
||||
This could be evidence of a missconfiguration, a policy violation or an account
|
||||
take over attempt that should be investigated
|
||||
data_source: []
|
||||
search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequirement=singleFactorAuthentication
|
||||
body.properties.authenticationDetails{}.succeeded=true | rename body.properties.*
|
||||
as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement
|
||||
search: ' `azuread` category=SignInLogs properties.authenticationRequirement=singleFactorAuthentication
|
||||
properties.authenticationDetails{}.succeeded=true | rename properties.*
|
||||
as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress, appDisplayName, authenticationRequirement
|
||||
| `azure_ad_successful_single_factor_authentication_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events in your Splunk environment.
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: Although not recommended, certain users may be required without
|
||||
multi-factor authentication. Filter as needed
|
||||
@@ -30,7 +30,7 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 90
|
||||
impact: 50
|
||||
message: Successful authentication for user $body.properties.userPrincipalName$
|
||||
message: Successful authentication for user $userPrincipalName$
|
||||
without MFA
|
||||
mitre_attack_id:
|
||||
- T1586
|
||||
@@ -52,12 +52,12 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.category
|
||||
- body.properties.authenticationRequirement
|
||||
- body.properties.authenticationDetails
|
||||
- body.properties.userPrincipalName
|
||||
- body.properties.ipAddress
|
||||
- body.properties.appDisplayName
|
||||
- category
|
||||
- properties.authenticationRequirement
|
||||
- properties.authenticationDetails
|
||||
- properties.userPrincipalName
|
||||
- properties.ipAddress
|
||||
- properties.appDisplayName
|
||||
risk_score: 45
|
||||
security_domain: identity
|
||||
tests:
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
name: Azure AD Unusual Number of Failed Authentications From Ip
|
||||
id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d
|
||||
version: 1
|
||||
version: 2
|
||||
date: '2022-07-11'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: Anomaly
|
||||
description: 'The following analytic identifies one source Ip failing to authenticate
|
||||
@@ -21,16 +21,18 @@ description: 'The following analytic identifies one source Ip failing to authent
|
||||
coverage. A similar analytic following the threshold model is `Azure AD Multiple
|
||||
Users Failing To Authenticate From Ip`.'
|
||||
data_source: []
|
||||
search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50126
|
||||
body.properties.authenticationDetails{}.succeeded= false | rename body.properties.*
|
||||
as * | bucket span=5m _time | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName)
|
||||
as tried_accounts by _time, ipAddress | eventstats avg(unique_accounts) as ip_avg
|
||||
, stdev(unique_accounts) as ip_std by ipAddress | eval upperBound=(ip_avg+ip_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1,
|
||||
0) | where isOutlier = 1 | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events in your Splunk environment.
|
||||
search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
|
||||
| rename properties.* as *
|
||||
| bucket span=5m _time
|
||||
| stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as userPrincipalName by _time, ipAddress
|
||||
| eventstats avg(unique_accounts) as ip_avg, stdev(unique_accounts) as ip_std by ipAddress
|
||||
| eval upperBound=(ip_avg+ip_std*3)
|
||||
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1,0)
|
||||
| where isOutlier = 1
|
||||
| `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
|
||||
Specifically, this analytic leverages the SignInLogs log category.
|
||||
known_false_positives: A source Ip failing to authenticate with multiple users is
|
||||
not a common for legitimate behavior.
|
||||
@@ -45,7 +47,7 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 90
|
||||
impact: 60
|
||||
message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$
|
||||
message: Possible Password Spraying attack against Azure AD from source ip $ipAddress$
|
||||
mitre_attack_id:
|
||||
- T1586
|
||||
- T1586.003
|
||||
@@ -67,17 +69,17 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.properties.status.errorCode
|
||||
- body.category
|
||||
- body.properties.authenticationDetails
|
||||
- body.properties.userPrincipalName
|
||||
- body.properties.ipAddress
|
||||
- properties.status.errorCode
|
||||
- category
|
||||
- properties.authenticationDetails
|
||||
- properties.userPrincipalName
|
||||
- properties.ipAddress
|
||||
risk_score: 54
|
||||
security_domain: access
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin.log
|
||||
source: mscs:azure:eventhub
|
||||
sourcetype: mscs:azure:eventhub
|
||||
update_timestamp: true
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD User Enabled And Password Reset
|
||||
id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268
|
||||
version: 1
|
||||
date: '2022-08-29'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies an Azure AD user enabling a previously
|
||||
@@ -10,12 +10,12 @@ description: The following analytic identifies an Azure AD user enabling a previ
|
||||
represent an adversary who has obtained administrative access and is trying to establish
|
||||
a backdoor identity within an Azure AD tenant.
|
||||
data_source: []
|
||||
search: ' `azuread` (body.operationName="Enable account" OR body.operationName="Reset
|
||||
password (by admin)" OR body.operationName="Update user") | transaction body.properties.targetResources{}.userPrincipalName
|
||||
startsWith=(body.operationName="Enable account") endsWith=(body.operationName="Reset
|
||||
password (by admin)") maxspan=2m | rename body.properties.* as * | rename targetResources{}.userPrincipalName
|
||||
search: ' `azuread` (operationName="Enable account" OR operationName="Reset password (by admin)"
|
||||
OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName
|
||||
startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m
|
||||
| rename properties.* as * | rename targetResources{}.userPrincipalName
|
||||
as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
|
||||
| stats values(body.operationName) values(initiatedBy) by _time, userPrincipalName,
|
||||
| stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName,
|
||||
result | `azure_ad_user_enabled_and_password_reset_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
@@ -31,12 +31,12 @@ tags:
|
||||
asset_type: Azure Active Directory
|
||||
confidence: 90
|
||||
impact: 50
|
||||
message: A user account, $displayName$, was enabled and its password reset within
|
||||
message: A user account, $userPrincipalName$, was enabled and its password reset within
|
||||
2 minutes by $initiatedBy$
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
observable:
|
||||
- name: displayName
|
||||
- name: userPrincipalName
|
||||
type: Other
|
||||
role:
|
||||
- Victim
|
||||
@@ -50,10 +50,10 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- body.operationName
|
||||
- body.properties.targetResources{}.userPrincipalName
|
||||
- body.properties.initiatedBy.user.userPrincipalName
|
||||
- body.properties.result
|
||||
- operationName
|
||||
- properties.targetResources{}.userPrincipalName
|
||||
- properties.initiatedBy.user.userPrincipalName
|
||||
- properties.result
|
||||
risk_score: 45
|
||||
security_domain: identity
|
||||
tests:
|
||||
|
||||
@@ -2,7 +2,7 @@ name: Azure AD User ImmutableId Attribute Updated
|
||||
id: 0c0badad-4536-4a84-a561-5ff760f3c00e
|
||||
version: 1
|
||||
date: '2022-09-02'
|
||||
author: Mauricio Velazco, Splunk
|
||||
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies the modification of the SourceAnchor
|
||||
@@ -20,12 +20,12 @@ description: The following analytic identifies the modification of the SourceAnc
|
||||
to Azure AD impersonating any user and bypassing the requirement to have a valid
|
||||
password and/or perform MFA.
|
||||
data_source: []
|
||||
search: ' `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
|
||||
| rename body.properties.* as * | rename targetResources{}.userPrincipalName as
|
||||
search: ' `azuread` operationName="Update user" properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor
|
||||
| rename properties.* as * | rename targetResources{}.userPrincipalName as
|
||||
userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename
|
||||
body.callerIpAddress as callerIpAddress | rename targetResources{}.modifiedProperties{}.newValue
|
||||
as modifiedProperties | stats values(userPrincipalName) values(modifiedProperties)
|
||||
by _time, initiatedBy, callerIpAddress, result, body.operationName | `azure_ad_user_immutableid_attribute_updated_filter`'
|
||||
callerIpAddress as callerIpAddress | rename targetResources{}.modifiedProperties{}.newValue
|
||||
as modifiedProperties | stats values(userPrincipalName) as userPrincipalName values(modifiedProperties)
|
||||
by _time, initiatedBy, callerIpAddress, result, operationName | `azure_ad_user_immutableid_attribute_updated_filter`'
|
||||
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
||||
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
|
||||
You must be ingesting Azure Active Directory events into your Splunk environment.
|
||||
|
||||
Reference in New Issue
Block a user