diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 3b45dfa676..80e4b8cf96 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -29,12 +29,12 @@ tags: asset_type: AWS Account confidence: 80 impact: 80 - message: A new virtual device $virtualMFADeviceName$ is added to user $user_arn$ + message: A new virtual device $virtualMFADeviceName$ is added to user $user_arn$ mitre_attack_id: - T1556 - T1556.006 observable: - - name: user_name + - name: user_arn type: User role: - Victim diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml index cda906ecfd..f0c5f3d7a1 100644 --- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml +++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml @@ -2,7 +2,7 @@ name: Azure Active Directory High Risk Sign-in id: 1ecff169-26d7-4161-9a7b-2ac4c8e61bea version: 1 date: '2022-07-11' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic triggers on a high risk sign-in against Azure @@ -10,13 +10,12 @@ description: The following analytic triggers on a high risk sign-in against Azur sign-in events using heuristics and machine learning to identify potentially malicious events and categorizes them in three categories high, medium and low. data_source: [] -search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high | - rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, +search: ' `azuread` category=UserRiskEvents properties.riskLevel=high | + rename properties.* as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress, activity, riskLevel, riskEventType, additionalInfo | `azure_active_directory_high_risk_sign_in_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft - Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. - You must be ingesting Azure Active Directory events in your Splunk environment. +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft + Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category. known_false_positives: Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives. @@ -31,7 +30,7 @@ tags: asset_type: Azure Active Directory confidence: 90 impact: 60 - message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$ + message: A high risk event was identified by Identify Protection for user $userPrincipalName$ mitre_attack_id: - T1586 - T1586.003 @@ -52,13 +51,13 @@ tags: - Splunk Cloud required_fields: - _time - - body.category - - body.properties.riskLevel - - body.properties.userPrincipalName - - body.properties.ipAddress - - body.properties.activity - - body.properties.riskEventType - - body.properties.additionalInfo + - category + - properties.riskLevel + - properties.userPrincipalName + - properties.ipAddress + - properties.activity + - properties.riskEventType + - properties.additionalInfo risk_score: 54 security_domain: identity tests: diff --git a/detections/cloud/azure_ad_application_administrator_role_assigned.yml b/detections/cloud/azure_ad_application_administrator_role_assigned.yml index bc539356c0..4ad15579c4 100644 --- a/detections/cloud/azure_ad_application_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_application_administrator_role_assigned.yml @@ -2,7 +2,7 @@ name: Azure AD Application Administrator Role Assigned id: eac4de87-7a56-4538-a21b-277897af6d8d version: 1 date: '2023-04-25' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP data_source: [] @@ -12,11 +12,11 @@ description: The following analytic identifies the assignment of the Application been granted access to a resource, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while impersonating the application. This ability to impersonate the applications identity may be an elevation of privilege over what the user can do via their role assignments. Red teams and adversaries alike may abuse this role to escalate their privileges in an Azure AD tenant. -search: ' `azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\"" - | rename body.properties.* as * +search: ' `azuread` "operationName"="Add member to role" "properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\"" + | rename properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy - | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName + | stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName | `azure_ad_application_administrator_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). @@ -57,10 +57,10 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.targetResources{}.userPrincipalName - - body.properties.targetResources{}.type - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.result + - properties.targetResources{}.userPrincipalName + - properties.targetResources{}.type + - properties.initiatedBy.user.userPrincipalName + - properties.result risk_score: 35 security_domain: endpoint tests: diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index 072f2fcaeb..92b822b851 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -2,7 +2,7 @@ name: Azure AD Authentication Failed During MFA Challenge id: e62c9c2e-bf51-4719-906c-3074618fcc1c version: 1 date: '2022-07-14' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: 'The following analytic identifies an authentication attempt event against @@ -11,12 +11,12 @@ description: 'The following analytic identifies an authentication attempt event This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. ' data_source: [] -search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 - | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, +search: ' `azuread` category=SignInLogs properties.status.errorCode=500121 + | rename properties.* as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft - Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events in your Splunk environment. +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft + Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. @@ -30,7 +30,7 @@ tags: asset_type: Azure Active Directory confidence: 90 impact: 60 - message: User $body.properties.userPrincipalName$ failed to pass MFA challenge + message: User $userPrincipalName$ failed to pass MFA challenge mitre_attack_id: - T1586 - T1586.003 @@ -52,13 +52,13 @@ tags: - Splunk Cloud required_fields: - _time - - body.category - - body.properties.status.errorCode - - body.properties.userPrincipalName - - body.properties.ipAddress - - body.properties.status.additionalDetails - - body.properties.appDisplayName - - body.properties.userAgent + - category + - properties.status.errorCode + - properties.userPrincipalName + - properties.ipAddress + - properties.status.additionalDetails + - properties.appDisplayName + - properties.userAgent risk_score: 54 security_domain: identity tests: diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml index 1b89d3b70a..279fd4c619 100644 --- a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -14,11 +14,11 @@ description: The following analytic identifies an Azure AD account with concurre data_source: [] search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs | rename properties.* as * | bucket span=5m _time | stats dc(ipAddress) AS unique_ips - values(ipAddress) values(appDisplayName) by _time, userPrincipalName | where unique_ips + values(ipAddress) as ipAddress values(appDisplayName) by _time, userPrincipalName | where unique_ips > 1 | `azure_ad_concurrent_sessions_from_different_ips_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml index 66e18c7f95..d2d8d4c115 100644 --- a/detections/cloud/azure_ad_external_guest_user_invited.yml +++ b/detections/cloud/azure_ad_external_guest_user_invited.yml @@ -13,10 +13,10 @@ description: The following analytic identifies the invitation of an external gue 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities` data_source: [] -search: '`azuread` "body.operationName"="Invite external user" | rename body.properties.* +search: '`azuread` "operationName"="Invite external user" | rename properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.type - as type | stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName + as type | stats values(userPrincipalName) as userPrincipalName by _time, type, initiatedBy, result, operationName | `azure_ad_external_guest_user_invited_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). @@ -53,10 +53,10 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.targetResources{}.userPrincipalName - - body.properties.targetResources{}.type - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.result + - properties.targetResources{}.userPrincipalName + - properties.targetResources{}.type + - properties.initiatedBy.user.userPrincipalName + - properties.result risk_score: 45 security_domain: threat tests: diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml index 023ece5b98..aa46aba9e3 100644 --- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -1,6 +1,6 @@ name: Azure AD Global Administrator Role Assigned id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c -version: 2 +version: 3 date: '2022-08-17' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production @@ -14,14 +14,15 @@ description: The following analytic identifies the assignment of the Azure AD Gl to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence or escalate their privileges in an Azure AD environment. data_source: [] -search: '`azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global - Administrator\"" | rename body.properties.* as * | rename targetResources{}.userPrincipalName - as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy - | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName +search: '`azuread` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="\"Global Administrator\"" + | rename properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName | `azure_ad_global_administrator_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the AuditLogs log category. known_false_positives: Administrators may legitimately assign the Global Administrator role to a user. Filter as needed. @@ -58,10 +59,10 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.targetResources{}.userPrincipalName - - body.properties.targetResources{}.type - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.result + - properties.targetResources{}.userPrincipalName + - properties.targetResources{}.type + - properties.initiatedBy.user.userPrincipalName + - properties.result risk_score: 72 security_domain: threat tests: diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml index c05ecdd09f..4ef53ba617 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -15,7 +15,7 @@ search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 prope by userPrincipalName, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_for_user_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml index 07d9f78714..1249a491ff 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml @@ -13,10 +13,10 @@ description: The following analytic identifies an Ip address failing to authenti data_source: [] search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false | rename properties.* as * | bucket span=5m _time | stats dc(_raw) AS failed_attempts - values(userPrincipalName) by ipAddress, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_from_ip_filter`' + values(userPrincipalName) as userPrincipalName by ipAddress, _time | where failed_attempts > 20 | `azure_ad_high_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index e54662ba1c..2e85f7f0df 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -2,7 +2,7 @@ name: Azure AD Multi-Factor Authentication Disabled id: 482dd42a-acfa-486b-a0bb-d6fcda27318e version: 1 date: '2022-08-10' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies an attempt to disable multi-factor @@ -11,14 +11,14 @@ description: The following analytic identifies an attempt to disable multi-facto and maintain persistence using a valid account. This way the attackers can keep persistance in the environment without adding new users. data_source: [] -search: '`azuread` body.category=AuditLogs body.operationName="Disable Strong Authentication" - | rename body.properties.* as * | rename targetResources{}.userPrincipalName as +search: '`azuread` category=AuditLogs operationName="Disable Strong Authentication" + | rename properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename targetResources{}.type as type | rename initiatedBy.user.userPrincipalName - as initiatedBy | stats values(userPrincipalName) by _time, type, body.operationName, + as initiatedBy | stats values(userPrincipalName) as userPrincipalName by _time, type, operationName, initiatedBy, result | `azure_ad_multi_factor_authentication_disabled_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft - Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the AuditLogs log category. known_false_positives: Legitimate use case may require for users to disable MFA. Filter as needed. @@ -54,10 +54,10 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.targetResources{}.userPrincipalName - - body.properties.targetResources{}.type - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.result + - properties.targetResources{}.userPrincipalName + - properties.targetResources{}.type + - properties.initiatedBy.user.userPrincipalName + - properties.result risk_score: 45 security_domain: identity tests: diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml index 02cf5f305b..942cdd9b0b 100644 --- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml +++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml @@ -2,7 +2,7 @@ name: Azure AD Multiple Failed MFA Requests For User id: 264ea131-ab1f-41b8-90e0-33ad1a1888ea version: 1 date: '2022-08-25' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies multiple failed multi-factor authentication @@ -18,13 +18,13 @@ description: The following analytic identifies multiple failed multi-factor auth this technique to bypass multi-factor authentication controls as reported by Mandiant and others. data_source: [] -search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 - | rename body.properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts - values(userPrincipalName) by userPrincipalName, status.additionalDetails, appDisplayName, +search: ' `azuread` category=SignInLogs properties.status.errorCode=500121 + | rename properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts + values(ipAddress) as ipAddress by userPrincipalName, status.additionalDetails, appDisplayName, userAgent, _time | where mfa_prompts > 10 | `azure_ad_multiple_failed_mfa_requests_for_user_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed. @@ -40,7 +40,7 @@ tags: asset_type: Azure Active Directory confidence: 90 impact: 60 - message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$ + message: Multiple Failed MFA requests for user $userPrincipalName$ mitre_attack_id: - T1586 - T1586.003 @@ -62,11 +62,11 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.status.errorCode - - body.category - - body.properties.authenticationDetails - - body.properties.userPrincipalName - - body.properties.ipAddress + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress risk_score: 54 security_domain: identity tests: diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 1ccdaa27bd..ed8e673478 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -2,7 +2,7 @@ name: Azure AD Multiple Users Failing To Authenticate From Ip id: 94481a6a-8f59-4c86-957f-55a71e3612a6 version: 1 date: '2022-07-12' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: Anomaly description: 'The following analytic identifies one source Ip failing to authenticate @@ -15,13 +15,15 @@ description: 'The following analytic identifies one source Ip failing to authent Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.' data_source: [] -search: ' `azuread` body.category= SignInLogs body.properties.status.errorCode=50126 - body.properties.authenticationDetails{}.succeeded= false | rename body.properties.* - as * | bucket span=5m _time | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) - as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' +search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false +| rename properties.* as * +| bucket span=5m _time +| stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as userPrincipalName by _time, ipAddress +| where unique_accounts > 30 +| `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. @@ -36,7 +38,7 @@ tags: asset_type: Azure Active Directory confidence: 90 impact: 70 - message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users + message: Source Ip $ipAddress$ failed to authenticate with 30 users within 5 minutes. mitre_attack_id: - T1586 @@ -59,17 +61,17 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.status.errorCode - - body.category - - body.properties.authenticationDetails - - body.properties.userPrincipalName - - body.properties.ipAddress + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress risk_score: 63 security_domain: identity tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true diff --git a/detections/cloud/azure_ad_new_custom_domain_added.yml b/detections/cloud/azure_ad_new_custom_domain_added.yml index 3846b77241..9842b46897 100644 --- a/detections/cloud/azure_ad_new_custom_domain_added.yml +++ b/detections/cloud/azure_ad_new_custom_domain_added.yml @@ -2,7 +2,7 @@ name: Azure AD New Custom Domain Added id: 30c47f45-dd6a-4720-9963-0bca6c8686ef version: 1 date: '2022-09-02' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies the addition of a new custom domain @@ -19,10 +19,10 @@ description: The following analytic identifies the addition of a new custom doma persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. data_source: [] -search: ' `azuread` body.operationName="Add unverified domain" "body.properties.result"=success - | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress +search: ' `azuread` operationName="Add unverified domain" "properties.result"=success + | rename properties.* as * | rename callerIpAddress as callerIpAddress | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName - as domain | stats values(domain) by _time, initiatedBy, result, body.operationName, + as domain | stats values(domain) by _time, initiatedBy, result, operationName, callerIpAddress | `azure_ad_new_custom_domain_added_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). @@ -58,11 +58,11 @@ tags: - Splunk Cloud required_fields: - _time - - body.operationName - - body.properties.result - - body.callerIpAddress - - body.properties.targetResources{}.displayName - - body.properties.initiatedBy.user.userPrincipalName + - operationName + - properties.result + - callerIpAddress + - properties.targetResources{}.displayName + - properties.initiatedBy.user.userPrincipalName risk_score: 54 security_domain: threat tests: diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml index 97374a53f5..759dc6c929 100644 --- a/detections/cloud/azure_ad_new_federated_domain_added.yml +++ b/detections/cloud/azure_ad_new_federated_domain_added.yml @@ -2,7 +2,7 @@ name: Azure AD New Federated Domain Added id: a87cd633-076d-4ab2-9047-977751a3c1a0 version: 1 date: '2022-09-02' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies the addition of a new federated domain @@ -19,10 +19,10 @@ description: The following analytic identifies the addition of a new federated d persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. data_source: [] -search: ' `azuread` body.operationName="Set domain authentication" "body.properties.result"=success - | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress +search: ' `azuread` operationName="Set domain authentication" "properties.result"=success + | rename properties.* as * | rename callerIpAddress as callerIpAddress | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName - as domain | stats values(domain) by _time, initiatedBy, result, body.operationName, + as domain | stats values(domain) by _time, initiatedBy, result, operationName, callerIpAddress | `azure_ad_new_federated_domain_added_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). @@ -57,11 +57,11 @@ tags: - Splunk Cloud required_fields: - _time - - body.operationName - - body.properties.result - - body.callerIpAddress - - body.properties.targetResources{}.displayName - - body.properties.initiatedBy.user.userPrincipalName + - operationName + - properties.result + - callerIpAddress + - properties.targetResources{}.displayName + - properties.initiatedBy.user.userPrincipalName risk_score: 81 security_domain: threat tests: diff --git a/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml index 36e01e7529..b40494d929 100644 --- a/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml @@ -11,11 +11,11 @@ description: The following analytic identifies the registration of a new Multi F data_source: [] search: ' `azuread` category=AuditLogs operationName="User registered security info" properties.operationType=Add | rename properties.* as * | rename targetResources{}.* - as * | stats values(userPrincipalName) by _time, resultDescription, result, callerIpAddress + as * | stats values(userPrincipalName) as userPrincipalName by _time, resultDescription, result, callerIpAddress | `azure_ad_new_mfa_method_registered_for_user_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the AuditLogs log category. known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. diff --git a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml index a970d1aae4..a7284495b6 100644 --- a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml @@ -2,7 +2,7 @@ name: Azure AD Privileged Authentication Administrator Role Assigned id: a7da845d-6fae-41cf-b823-6c0b8c55814a version: 1 date: '2023-04-25' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP data_source: [] @@ -10,11 +10,11 @@ description: The following analytic identifies the assignment of the Privileged methods for any user in Azure Active Directory, including privileged roles like Global Administrators. Users with this role can change credentials for people who may have access to sensitive or private information or critical configuration inside and outside of Azure Active Directory. Changing the credentials of a user may mean the ability to assume that users identity and permissions. Red teams and adversaries alike may abuse this role to escalate their privileges. -search: ' `azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" - | rename body.properties.* as * +search: ' `azuread` "operationName"="Add member to role" "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" + | rename properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy - | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName + | stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName | `azure_ad_privileged_authentication_administrator_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). @@ -51,10 +51,10 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.targetResources{}.userPrincipalName - - body.properties.targetResources{}.type - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.result + - properties.targetResources{}.userPrincipalName + - properties.targetResources{}.type + - properties.initiatedBy.user.userPrincipalName + - properties.result risk_score: 50 security_domain: identity tests: diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index 587b9b1738..6fbfdb2ba3 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -2,7 +2,7 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a version: 1 date: '2022-08-29' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies the assignment of sensitive and privileged @@ -10,14 +10,14 @@ description: The following analytic identifies the assignment of sensitive and p may assign these roles to a compromised account to establish Persistence in an Azure AD environment. data_source: [] -search: ' `azuread` "body.operationName"="Add member to role" | rename body.properties.* as * +search: ' `azuread` "operationName"="Add member to role" | rename properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.modifiedProperties{}.newValue as roles | eval role=mvindex(roles,1) | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True - | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description + | stats values(userPrincipalName) as userPrincipalName by _time, initiatedBy, result, operationName, role, description | `azure_ad_privileged_role_assigned_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). @@ -58,10 +58,10 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.targetResources{}.userPrincipalName - - body.properties.targetResources{}.type - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.result + - properties.targetResources{}.userPrincipalName + - properties.targetResources{}.type + - properties.initiatedBy.user.userPrincipalName + - properties.result risk_score: 63 security_domain: audit tests: diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml index 8a3f05796a..9290d9186b 100644 --- a/detections/cloud/azure_ad_service_principal_created.yml +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -14,14 +14,16 @@ description: The following analytic identifies the creation of a Service Princip access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. data_source: [] -search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=* - | rename body.properties.* as * | rename targetResources{}.displayName as displayName - | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.type - as type | stats values(displayName) by _time, type, initiatedBy, result, body.operationName +search: '`azuread` operationName="Add service principal" properties.initiatedBy.user.id=* + | rename properties.* as * + | rename targetResources{}.displayName as displayName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.type as type + | stats values(displayName) as displayName by _time, type, initiatedBy, result, operationName | `azure_ad_service_principal_created_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment thorough an EventHub. Specifically, this analytic leverages the AuditLogs log category. known_false_positives: Administrator may legitimately create Service Principal. Filter as needed. @@ -55,10 +57,10 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.targetResources{}.displayName - - body.properties.targetResources{}.type - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.result + - properties.targetResources{}.displayName + - properties.targetResources{}.type + - properties.initiatedBy.user.userPrincipalName + - properties.result risk_score: 45 security_domain: threat tests: diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml index b8342f6141..2fe3dcefae 100644 --- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -2,7 +2,7 @@ name: Azure AD Service Principal New Client Credentials id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a version: 2 date: '2022-08-17' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies the addition of new credentials for Service @@ -16,9 +16,9 @@ description: The following analytic identifies the addition of new credentials f with privileged access, attackers may also escalate their privileges in an Azure AD environment by adding new credentials and logging in as the service principal. data_source: [] -search: ' `azuread` body.category=AuditLogs body.operationName="Update application*Certificates - and secrets management " | rename body.* as * | rename properties.* as * | rename - targetResources{}.* as * | stats values(displayName) by _time, initiatedBy.user.userPrincipalName, +search: ' `azuread` category=AuditLogs operationName="Update application*Certificates + and secrets management " | rename * as * | rename properties.* as * | rename + targetResources{}.* as * | stats values(displayName) as displayName by _time, initiatedBy.user.userPrincipalName, modifiedProperties{}.newValue | `azure_ad_service_principal_new_client_credentials_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). @@ -40,7 +40,7 @@ tags: asset_type: Azure Active Directory confidence: 50 impact: 70 - message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$ + message: New credentials added for Service Principal $properties.targetResources{}.displayName$ mitre_attack_id: - T1098 - T1098.001 @@ -59,11 +59,11 @@ tags: - Splunk Cloud required_fields: - _time - - body.category - - body.operationName - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.targetResources{}.displayName - - body.properties.targetResources{}.modifiedProperties{}.newValue + - category + - operationName + - properties.initiatedBy.user.userPrincipalName + - properties.targetResources{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue risk_score: 35 security_domain: threat tests: diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml index 6983a723ec..b655bce029 100644 --- a/detections/cloud/azure_ad_service_principal_owner_added.yml +++ b/detections/cloud/azure_ad_service_principal_owner_added.yml @@ -2,7 +2,7 @@ name: Azure AD Service Principal Owner Added id: 7ddf2084-6cf3-4a44-be83-474f7b73c701 version: 2 date: '2022-08-30' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies the addition of a new owner for a Service @@ -15,15 +15,18 @@ description: The following analytic identifies the addition of a new owner for a and obtain single-factor access to an Azure AD environment. Attackers who are looking to escalate their privileges by leveraging a Service Principals permissions may also add a new owner. data_source: [] -search: ' `azuread` body.operationName="Add owner to application" | rename body.properties.* - as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName - as newOwner | rename targetResources{}.modifiedProperties{}.newValue as displayName - | eval displayName = mvindex(displayName,1) | where initiatedBy!=newOwner | stats - values(displayName) by _time, initiatedBy, result, body.operationName, newOwner +search: ' `azuread` operationName="Add owner to application" + | rename properties.* as * + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.userPrincipalName as newOwner + | rename targetResources{}.modifiedProperties{}.newValue as displayName + | eval displayName = mvindex(displayName,1) + | where initiatedBy!=newOwner + | stats values(displayName) as displayName by _time, initiatedBy, result, operationName, newOwner | `azure_ad_service_principal_owner_added_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the AuditLogs log category. known_false_positives: Administrator may legitimately add new owners for Service Principals. Filter as needed. @@ -54,11 +57,11 @@ tags: - Splunk Cloud required_fields: - _time - - body.operationName - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.targetResources{}.userPrincipalName - - body.properties.targetResources{}.modifiedProperties{}.newValue - - body.propertiesresult + - operationName + - properties.initiatedBy.user.userPrincipalName + - properties.targetResources{}.userPrincipalName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.result risk_score: 54 security_domain: audit tests: diff --git a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml index 7d40fb06ef..68b962dea9 100644 --- a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml +++ b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml @@ -14,11 +14,11 @@ description: The following analytic identifies an Azure AD account successfully data_source: [] search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=SignInLogs | rename properties.* as * | bucket span=5m _time | stats dc(ipAddress) AS unique_ips - values(ipAddress) values(appDisplayName) by _time, userPrincipalName | where unique_ips + values(ipAddress) as ipAddress values(appDisplayName) by _time, userPrincipalName | where unique_ips > 1 | `azure_ad_successful_authentication_from_different_ips_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index eced18c064..24ca26a17e 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -2,7 +2,7 @@ name: Azure AD Successful PowerShell Authentication id: 62f10052-d7b3-4e48-b57b-56f8e3ac7ceb version: 1 date: '2022-07-13' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies a successful authentication event against @@ -11,13 +11,13 @@ description: The following analytic identifies a successful authentication event and red teams alike will perform enumeration and discovery techniques. One method of executing these techniques is leveraging the native PowerShell modules. data_source: [] -search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true - body.properties.appDisplayName="Azure Active Directory PowerShell" | rename body.properties.* - as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent +search: ' `azuread` category=SignInLogs properties.authenticationDetails{}.succeeded=true + properties.appDisplayName="Microsoft Azure PowerShell" | rename properties.* + as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress, appDisplayName, userAgent | `azure_ad_successful_powershell_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft - Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events in your Splunk environment. +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft + Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed. @@ -32,7 +32,7 @@ tags: asset_type: Azure Active Directory confidence: 90 impact: 60 - message: Successful authentication for user $body.properties.userPrincipalName$ + message: Successful authentication for user $userPrincipalName$ using PowerShell. mitre_attack_id: - T1586 @@ -54,12 +54,12 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.appDisplayName - - body.category - - body.properties.userPrincipalName - - body.properties.ipAddress - - body.properties.appDisplayName - - body.properties.userAgent + - properties.appDisplayName + - category + - properties.userPrincipalName + - properties.ipAddress + - properties.appDisplayName + - properties.userAgent risk_score: 54 security_domain: identity tests: diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index d5bf586fc3..6f2eb12f80 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -2,7 +2,7 @@ name: Azure AD Successful Single-Factor Authentication id: a560e7f6-1711-4353-885b-40be53101fcd version: 1 date: '2022-07-12' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies a successful authentication event against @@ -10,13 +10,13 @@ description: The following analytic identifies a successful authentication event This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated data_source: [] -search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequirement=singleFactorAuthentication - body.properties.authenticationDetails{}.succeeded=true | rename body.properties.* - as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement +search: ' `azuread` category=SignInLogs properties.authenticationRequirement=singleFactorAuthentication + properties.authenticationDetails{}.succeeded=true | rename properties.* + as * | stats values(userPrincipalName) as userPrincipalName by _time, ipAddress, appDisplayName, authenticationRequirement | `azure_ad_successful_single_factor_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft - Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events in your Splunk environment. +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft + Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed @@ -30,7 +30,7 @@ tags: asset_type: Azure Active Directory confidence: 90 impact: 50 - message: Successful authentication for user $body.properties.userPrincipalName$ + message: Successful authentication for user $userPrincipalName$ without MFA mitre_attack_id: - T1586 @@ -52,12 +52,12 @@ tags: - Splunk Cloud required_fields: - _time - - body.category - - body.properties.authenticationRequirement - - body.properties.authenticationDetails - - body.properties.userPrincipalName - - body.properties.ipAddress - - body.properties.appDisplayName + - category + - properties.authenticationRequirement + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + - properties.appDisplayName risk_score: 45 security_domain: identity tests: diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 367676c2a9..2587f803cd 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -1,8 +1,8 @@ name: Azure AD Unusual Number of Failed Authentications From Ip id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d -version: 1 +version: 2 date: '2022-07-11' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: Anomaly description: 'The following analytic identifies one source Ip failing to authenticate @@ -21,16 +21,18 @@ description: 'The following analytic identifies one source Ip failing to authent coverage. A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.' data_source: [] -search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50126 - body.properties.authenticationDetails{}.succeeded= false | rename body.properties.* - as * | bucket span=5m _time | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) - as tried_accounts by _time, ipAddress | eventstats avg(unique_accounts) as ip_avg - , stdev(unique_accounts) as ip_std by ipAddress | eval upperBound=(ip_avg+ip_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, - 0) | where isOutlier = 1 | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft - Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events in your Splunk environment. +search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false + | rename properties.* as * + | bucket span=5m _time + | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as userPrincipalName by _time, ipAddress + | eventstats avg(unique_accounts) as ip_avg, stdev(unique_accounts) as ip_std by ipAddress + | eval upperBound=(ip_avg+ip_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1,0) + | where isOutlier = 1 + | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft + Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. @@ -45,7 +47,7 @@ tags: asset_type: Azure Active Directory confidence: 90 impact: 60 - message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$ + message: Possible Password Spraying attack against Azure AD from source ip $ipAddress$ mitre_attack_id: - T1586 - T1586.003 @@ -67,17 +69,17 @@ tags: - Splunk Cloud required_fields: - _time - - body.properties.status.errorCode - - body.category - - body.properties.authenticationDetails - - body.properties.userPrincipalName - - body.properties.ipAddress + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress risk_score: 54 security_domain: access tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index ee5ece7b03..e1bad996bb 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -2,7 +2,7 @@ name: Azure AD User Enabled And Password Reset id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268 version: 1 date: '2022-08-29' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies an Azure AD user enabling a previously @@ -10,12 +10,12 @@ description: The following analytic identifies an Azure AD user enabling a previ represent an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant. data_source: [] -search: ' `azuread` (body.operationName="Enable account" OR body.operationName="Reset - password (by admin)" OR body.operationName="Update user") | transaction body.properties.targetResources{}.userPrincipalName - startsWith=(body.operationName="Enable account") endsWith=(body.operationName="Reset - password (by admin)") maxspan=2m | rename body.properties.* as * | rename targetResources{}.userPrincipalName +search: ' `azuread` (operationName="Enable account" OR operationName="Reset password (by admin)" + OR operationName="Update user") | transaction properties.targetResources{}.userPrincipalName + startsWith=(operationName="Enable account") endsWith=(operationName="Reset password (by admin)") maxspan=2m + | rename properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy - | stats values(body.operationName) values(initiatedBy) by _time, userPrincipalName, + | stats values(operationName) values(initiatedBy) as initiatedBy by _time, userPrincipalName, result | `azure_ad_user_enabled_and_password_reset_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). @@ -31,12 +31,12 @@ tags: asset_type: Azure Active Directory confidence: 90 impact: 50 - message: A user account, $displayName$, was enabled and its password reset within + message: A user account, $userPrincipalName$, was enabled and its password reset within 2 minutes by $initiatedBy$ mitre_attack_id: - T1098 observable: - - name: displayName + - name: userPrincipalName type: Other role: - Victim @@ -50,10 +50,10 @@ tags: - Splunk Cloud required_fields: - _time - - body.operationName - - body.properties.targetResources{}.userPrincipalName - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.result + - operationName + - properties.targetResources{}.userPrincipalName + - properties.initiatedBy.user.userPrincipalName + - properties.result risk_score: 45 security_domain: identity tests: diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml index f40a84d063..7ffbc568e8 100644 --- a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -2,7 +2,7 @@ name: Azure AD User ImmutableId Attribute Updated id: 0c0badad-4536-4a84-a561-5ff760f3c00e version: 1 date: '2022-09-02' -author: Mauricio Velazco, Splunk +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production type: TTP description: The following analytic identifies the modification of the SourceAnchor @@ -20,12 +20,12 @@ description: The following analytic identifies the modification of the SourceAnc to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. data_source: [] -search: ' `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor - | rename body.properties.* as * | rename targetResources{}.userPrincipalName as +search: ' `azuread` operationName="Update user" properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor + | rename properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename - body.callerIpAddress as callerIpAddress | rename targetResources{}.modifiedProperties{}.newValue - as modifiedProperties | stats values(userPrincipalName) values(modifiedProperties) - by _time, initiatedBy, callerIpAddress, result, body.operationName | `azure_ad_user_immutableid_attribute_updated_filter`' + callerIpAddress as callerIpAddress | rename targetResources{}.modifiedProperties{}.newValue + as modifiedProperties | stats values(userPrincipalName) as userPrincipalName values(modifiedProperties) + by _time, initiatedBy, callerIpAddress, result, operationName | `azure_ad_user_immutableid_attribute_updated_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment.