diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index e2fd07a372..d813551d8c 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -11,7 +11,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50 | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake. references: diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml new file mode 100644 index 0000000000..972109370c --- /dev/null +++ b/detections/cloud/azure_ad_external_guest_user_invited.yml @@ -0,0 +1,70 @@ +name: Azure AD External Guest User Invited +id: c1fb4edb-cab1-4359-9b40-925ffd797fb5 +version: 1 +date: '2022-08-18' +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies the invitation of an external guest user within Azure AD. + With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. + External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. + An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External + Identities`' +search: '`azuread` "body.operationName"="Invite external user" + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.type as type + | stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName + | `azure_ad_external_guest_user_invited_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrator may legitimately invite external guest users. Filter as needed. +references: +- https://dirkjanm.io/assets/raw/US-22-Mollema-Backdooring-and-hijacking-Azure-AD-accounts_final.pdf +- https://www.blackhat.com/us-22/briefings/schedule/#backdooring-and-hijacking-azure-ad-accounts-by-abusing-external-identities-26999 +- https://attack.mitre.org/techniques/T1136/003/ +- https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit.log + impact: 50 + kill_chain_phases: + - Exploitation + message: External Guest User $userPrincipalName$ initiated by $initiatedBy$ + mitre_attack_id: + - T1136.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.targetResources{}.userPrincipalName + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 45 + security_domain: threat diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml new file mode 100644 index 0000000000..a1758b24ce --- /dev/null +++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml @@ -0,0 +1,70 @@ +name: Azure AD Global Administrator Role Assigned +id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c +version: 1 +date: '2022-08-17' +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. + The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. + While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. + Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment. +search: '`azuread` "body.operationName"="Add member to role" "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global Administrator\"" + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName + | `azure_ad_global_administrator_role_assigned_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrators may legitimately assign the Global Administrator role to a user. Filter as needed. +references: +- https://o365blog.com/post/admin/ +- https://adsecurity.org/?p=4277 +- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors +- https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning +- https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin +- https://attack.mitre.org/techniques/T1098/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit.log + impact: 80 + kill_chain_phases: + - Exploitation + message: Global Administrator Role assigned for User $userPrincipalName$ initiated by $initiatedBy$ + mitre_attack_id: + - T1098.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.targetResources{}.userPrincipalName + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 72 + security_domain: threat diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 01d0c876ed..62c94fce3a 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -17,7 +17,8 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | stats dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs. log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: diff --git a/detections/cloud/azure_ad_new_custom_domain_added.yml b/detections/cloud/azure_ad_new_custom_domain_added.yml new file mode 100644 index 0000000000..85e686e262 --- /dev/null +++ b/detections/cloud/azure_ad_new_custom_domain_added.yml @@ -0,0 +1,73 @@ +name: Azure AD New Custom Domain Added +id: 30c47f45-dd6a-4720-9963-0bca6c8686ef +version: 1 +date: '2022-09-02' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain + is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. + Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a + single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for + email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, + the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique + to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. +search: ' `azuread` body.operationName="Add unverified domain" "body.properties.result"=success + | rename body.properties.* as * + | rename body.callerIpAddress as callerIpAddress + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.displayName as domain + | stats values(domain) by _time, initiatedBy, result, body.operationName, callerIpAddress + | `azure_ad_new_custom_domain_added_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: In most organizations, new customm domains will be updated infrequently. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/domains-manage +- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13 +- https://o365blog.com/post/federation-vulnerability/ +- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html +- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors +- https://attack.mitre.org/techniques/T1484/002/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log + impact: 60 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new custom domain, $domain$ , was added by $initiatedBy$ + mitre_attack_id: + - T1484 + - T1484.002 + nist: + - DE.CM + observable: + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.operationName + - body.properties.result + - body.callerIpAddress + - body.properties.targetResources{}.displayName + - body.properties.initiatedBy.user.userPrincipalName + risk_score: 54 + security_domain: threat diff --git a/detections/cloud/azure_ad_new_federated_domain_added.yml b/detections/cloud/azure_ad_new_federated_domain_added.yml new file mode 100644 index 0000000000..d95c1650b5 --- /dev/null +++ b/detections/cloud/azure_ad_new_federated_domain_added.yml @@ -0,0 +1,72 @@ +name: Azure AD New Federated Domain Added +id: a87cd633-076d-4ab2-9047-977751a3c1a0 +version: 1 +date: '2022-09-02' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution + of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. + Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a + single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for + email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, + the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique + to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. +search: ' `azuread` body.operationName="Set domain authentication" "body.properties.result"=success + | rename body.properties.* as * + | rename body.callerIpAddress as callerIpAddress + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.displayName as domain + | stats values(domain) by _time, initiatedBy, result, body.operationName, callerIpAddress + | `azure_ad_new_federated_domain_added_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: In most organizations, domain federation settings will be updated infrequently. Filter as needed. +references: +- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13 +- https://o365blog.com/post/federation-vulnerability/ +- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html +- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors +- https://attack.mitre.org/techniques/T1484/002/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log + impact: 90 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new federated domain, $domain$ , was added by $initiatedBy$ + mitre_attack_id: + - T1484 + - T1484.002 + nist: + - DE.CM + observable: + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.operationName + - body.properties.result + - body.callerIpAddress + - body.properties.targetResources{}.displayName + - body.properties.initiatedBy.user.userPrincipalName + risk_score: 81 + security_domain: threat diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml new file mode 100644 index 0000000000..fcfccacc2b --- /dev/null +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -0,0 +1,72 @@ +name: Azure AD Privileged Role Assigned +id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a +version: 1 +date: '2022-08-29' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. + Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment. +search: ' `azuread` "body.operationName"="Add member to role" + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.modifiedProperties{}.newValue as roles + | eval role=mvindex(roles,1) + | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True + | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description + | `azure_ad_privileged_role_assigned_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roles +- https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference +- https://adsecurity.org/?p=4277 +- https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors +- https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning +- https://attack.mitre.org/techniques/T1098/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log + impact: 70 + kill_chain_phases: + - Installation + message: A privileged Azure AD role was assigned for User $userPrincipalName$ initiated by $initiatedBy$ + mitre_attack_id: + - T1098 + - T1098.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.targetResources{}.userPrincipalName + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 63 + security_domain: audit diff --git a/detections/cloud/azure_ad_service_principal_created.yml b/detections/cloud/azure_ad_service_principal_created.yml new file mode 100644 index 0000000000..04525cb57d --- /dev/null +++ b/detections/cloud/azure_ad_service_principal_created.yml @@ -0,0 +1,70 @@ +name: Azure AD Service Principal Created +id: f8ba49e7-ffd3-4b53-8f61-e73974583c5d +version: 1 +date: '2022-08-17' +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the creation of a Service Principal in an Azure AD environment. + An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. + Service Principal authentication does not support multi-factor authentication nor conditional access policies. + Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. +search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=* + | rename body.properties.* as * + | rename targetResources{}.displayName as displayName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.type as type + | stats values(displayName) by _time, type, initiatedBy, result, body.operationName + | `azure_ad_service_principal_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrator may legitimately create Service Principal. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals +- https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-8.2.0 +- https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns +- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html +- https://attack.mitre.org/techniques/T1136/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit.log + impact: 50 + kill_chain_phases: + - Exploitation + message: Service Principal named $displayName$ created by $initiatedBy$ + mitre_attack_id: + - T1136.003 + nist: + - DE.CM + observable: + - name: displayName + type: Other + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.properties.targetResources{}.displayName + - body.properties.targetResources{}.type + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 45 + security_domain: threat diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml new file mode 100644 index 0000000000..e646b2d3cd --- /dev/null +++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml @@ -0,0 +1,73 @@ +name: Azure AD Service Principal New Client Credentials +id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a +version: 1 +date: '2022-08-17' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. + These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. + Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.' +search: ' `azuread` body.category=AuditLogs body.operationName="Update application*Certificates and secrets management " + | rename body.* as * + | rename properties.* as * + | rename targetResources{}.* as * + | stats values(displayName) by _time, initiatedBy.user.userPrincipalName, modifiedProperties{}.newValue + | `azure_ad_service_principal_new_client_credentials_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1098/001/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/ +- https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/ +- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html +- https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + - Installation + message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$ + mitre_attack_id: + - T1098 + - T1098.001 + nist: + - DE.CM + observable: + - name: displayName + type: User + role: + - Victim + - name: initiatedBy.user.userPrincipalName + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.category + - body.operationName + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.targetResources{}.displayName + - body.properties.targetResources{}.modifiedProperties{}.newValue + risk_score: 63 + security_domain: threat diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml new file mode 100644 index 0000000000..3bca51d651 --- /dev/null +++ b/detections/cloud/azure_ad_service_principal_owner_added.yml @@ -0,0 +1,70 @@ +name: Azure AD Service Principal Owner Added +id: 7ddf2084-6cf3-4a44-be83-474f7b73c701 +version: 1 +date: '2022-08-30' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. + An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. + Service Principal authentication does not support multi-factor authentication nor conditional access policies. + Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. +search: ' `azuread` body.operationName="Add owner to application" + | rename body.properties.* as * + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.userPrincipalName as newOwner + | rename targetResources{}.modifiedProperties{}.newValue as displayName + | eval displayName = mvindex(displayName,1) + | where initiatedBy!=newOwner + | stats values(displayName) by _time, initiatedBy, result, body.operationName, newOwner + | `azure_ad_service_principal_owner_added_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Administrator may legitimately add new owners for Service Principals. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1098/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit.log + impact: 60 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new owner was added for service principal $displayName$ by $initiatedBy$ + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: displayName + type: Other + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.operationName + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.targetResources{}.userPrincipalName + - body.properties.targetResources{}.modifiedProperties{}.newValue + - body.propertiesresult + risk_score: 54 + security_domain: audit diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml index c67bf0500c..64a8557e95 100644 --- a/detections/cloud/azure_ad_successful_powershell_authentication.yml +++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml @@ -12,7 +12,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetai | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent | `azure_ad_successful_powershell_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed. references: diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml index e86cbcc422..9f96956096 100644 --- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml +++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml @@ -11,7 +11,7 @@ search: ' `azuread` body.category=SignInLogs body.properties.authenticationRequ | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement | `azure_ad_successful_single_factor_authentication_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed references: diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index dabd3a2a14..ded1815871 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -26,7 +26,7 @@ search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignI | eval upperBound=(ip_avg+ip_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' -how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. references: diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml new file mode 100644 index 0000000000..aeda4f8caf --- /dev/null +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -0,0 +1,65 @@ +name: Azure AD User Enabled And Password Reset +id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268 +version: 1 +date: '2022-08-29' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: 'The following analytic identifies an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This behavior could represent + an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant.' +search: ' `azuread` (body.operationName="Enable account" OR body.operationName="Reset password (by admin)" OR body.operationName="Update user") + | transaction body.properties.targetResources{}.userPrincipalName startsWith=(body.operationName="Enable account") endsWith=(body.operationName="Reset password (by admin)") maxspan=2m + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | stats values(body.operationName) values(initiatedBy) by _time, userPrincipalName, result + | `azure_ad_user_enabled_and_password_reset_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: While not common, Administrators may enable accounts and reset their passwords for legitimate reasons. Filter as needed. +references: +- https://attack.mitre.org/techniques/T1098/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_enable_and_reset/azure-audit.log + impact: 50 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A user account, $displayName$, was enabled and its password reset within 2 minutes by $initiatedBy$ + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: displayName + type: Other + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - body.operationName + - body.properties.targetResources{}.userPrincipalName + - body.properties.initiatedBy.user.userPrincipalName + - body.properties.result + risk_score: 45 + security_domain: identity diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml new file mode 100644 index 0000000000..77f228ca80 --- /dev/null +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -0,0 +1,72 @@ +name: Azure AD User ImmutableId Attribute Updated +id: 0c0badad-4536-4a84-a561-5ff760f3c00e +version: 1 +date: '2022-09-02' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute + is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. + Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a + single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for + email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, + the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique + to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA. +search: ' `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor + | rename body.properties.* as * + | rename targetResources{}.userPrincipalName as userPrincipalName + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename body.callerIpAddress as callerIpAddress + | rename targetResources{}.modifiedProperties{}.newValue as modifiedProperties + | stats values(userPrincipalName) values(modifiedProperties) by _time, initiatedBy, callerIpAddress, result, body.operationName + | `azure_ad_user_immutableid_attribute_updated_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: The SourceAnchor (also called ImmutableId) Azure AD attribute has legitimate uses for directory synchronization. Investigate and filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-design-concepts +- https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13 +- https://o365blog.com/post/federation-vulnerability/ +- https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html +- https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors +- https://attack.mitre.org/techniques/T1098/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit.log + impact: 50 + kill_chain_phases: + - Installation + - Actions on Objectives + message: The SourceAnchor or ImmutableID attribute has been modified for user $userPrincipalName$ by $initiatedBy$ + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: initiatedBy + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + risk_score: 45 + security_domain: threat diff --git a/detections/cloud/azure_automation_account_created.yml b/detections/cloud/azure_automation_account_created.yml new file mode 100644 index 0000000000..f188527f50 --- /dev/null +++ b/detections/cloud/azure_automation_account_created.yml @@ -0,0 +1,74 @@ +name: Azure Automation Account Created +id: 860902fd-2e76-46b3-b050-ba548dab576c +version: 1 +date: '2022-08-18' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows + administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker. + Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities. + Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. +search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation account" status.value=Succeeded + | dedup object + | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path + | `azure_automation_account_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. + Specifically, this analytic leverages the Azure Activity log category. +known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/automation/overview +- https://docs.microsoft.com/en-us/azure/automation/automation-create-standalone-account?tabs=azureportal +- https://docs.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker +- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html +- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ +- https://attack.mitre.org/techniques/T1136/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity.log + impact: 70 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new Azure Automation account $object$ was created by $caller$ + mitre_attack_id: + - T1136 + - T1136.003 + nist: + - DE.CM + observable: + - name: object + type: Other + role: + - Victim + - name: caller + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - operationName.localizedValue + - status.value + - object + - caller + - claims.ipaddr + - resourceGroupName + - object_path + risk_score: 63 + security_domain: audit diff --git a/detections/cloud/azure_automation_runbook_created.yml b/detections/cloud/azure_automation_runbook_created.yml new file mode 100644 index 0000000000..4d708b5f11 --- /dev/null +++ b/detections/cloud/azure_automation_runbook_created.yml @@ -0,0 +1,73 @@ +name: Azure Automation Runbook Created +id: 178d696d-6dc6-4ee8-9d25-93fee34eaf5b +version: 1 +date: '2022-08-22' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows + administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. + Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc. +search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded + | dedup object + | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path + | `azure_automation_runbook_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. + Specifically, this analytic leverages the Azure Activity log category. +known_false_positives: Administrators may legitimately create Azure Automation Runbooks. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/automation/overview +- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types +- https://docs.microsoft.com/en-us/azure/automation/manage-runbooks +- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html +- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ +- https://attack.mitre.org/techniques/T1136/003/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques//T1078.004/azure_automation_runbook/azure-activity.log + impact: 70 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new Azure Automation Runbook $object$ was created by $caller$ + mitre_attack_id: + - T1136 + - T1136.003 + nist: + - DE.CM + observable: + - name: object + type: Other + role: + - Victim + - name: caller + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - operationName.localizedValue + - status.value + - object + - caller + - claims.ipaddr + - resourceGroupName + - object_path + risk_score: 63 + security_domain: audit diff --git a/detections/cloud/azure_runbook_webhook_created.yml b/detections/cloud/azure_runbook_webhook_created.yml new file mode 100644 index 0000000000..ba804d57b1 --- /dev/null +++ b/detections/cloud/azure_runbook_webhook_created.yml @@ -0,0 +1,73 @@ +name: Azure Runbook Webhook Created +id: e98944a9-92e4-443c-81b8-a322e33ce75a +version: 1 +date: '2022-08-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows + administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. + One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet. + An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM. + This provides a persistent foothold on the environment. +search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded + | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path + | `azure_runbook_webhook_created_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. + Specifically, this analytic leverages the Azure Activity log category. +known_false_positives: Administrators may legitimately create Azure Runbook Webhooks. Filter as needed. +references: +- https://docs.microsoft.com/en-us/azure/automation/overview +- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types +- https://docs.microsoft.com/en-us/azure/automation/automation-webhooks?tabs=portal +- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html +- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/ +- https://attack.mitre.org/techniques/T1078/004/ +tags: + analytic_story: + - Azure Active Directory Persistence + asset_type: Azure + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity.log + impact: 70 + kill_chain_phases: + - Exploitation + message: A new Azure Runbook Webhook $object$ was created by $caller$ + mitre_attack_id: + - T1078 + - T1078.004 + nist: + - DE.CM + observable: + - name: object + type: Other + role: + - Victim + - name: caller + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - operationName.localizedValue + - status.value + - object + - caller + - claims.ipaddr + - resourceGroupName + - object_path + risk_score: 63 + security_domain: threat diff --git a/lookups/privileged_azure_ad_roles.csv b/lookups/privileged_azure_ad_roles.csv new file mode 100644 index 0000000000..877df539cd --- /dev/null +++ b/lookups/privileged_azure_ad_roles.csv @@ -0,0 +1,29 @@ +azureadrole,isprvilegedadrole,description +"""Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps. +"""Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user. +"""Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials. +"""Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices. +"""Azure DevOps Administrator""",True,Can manage Azure DevOps policies and settings. +"""Azure Information Protection Administrator""",True,Can manage all aspects of the Azure Information Protection product. +"""Cloud Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps except App Proxy. +"""Cloud Device Administrator""",True,Limited access to manage devices in Azure AD. +"""Compliance Administrator""",True,Can read and manage compliance configuration and reports in Azure AD and Microsoft 365. +"""Conditional Access Administrator""",True,Can manage Conditional Access capabilities. +"""Exchange Administrator""",True,Can manage all aspects of the Exchange product. +"""External Identity Provider Administrator""",True,Can configure identity providers for use in direct federation. +"""Groups Administrator""",True,Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports. +"""Helpdesk Administrator""",True,Can reset passwords for non-administrators and Helpdesk Administrators. +"""Hybrid Identity Administrator""",True,Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings. +"""Intune Administrator""",True,Can manage all aspects of the Intune product. +"""License Administrator""",True,Can manage product licenses on users and groups. +"""Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications. +"""Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators. +"""Privileged Authentication Administrator""",True,Can access to view, set and reset authentication method information for any user (admin or non-admin). +"""Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management. +"""Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365. +"""SharePoint Administrator""",True,Can manage all aspects of the SharePoint service. +"""Teams Administrator""",True,Can manage the Microsoft Teams service. +"""User Administrator""",True,Can manage all aspects of users and groups, including resetting passwords for limited admins. +"""Windows 365 Administrator""",True,Can provision and manage all aspects of Cloud PCs. + + diff --git a/lookups/privileged_azure_ad_roles.yml b/lookups/privileged_azure_ad_roles.yml new file mode 100644 index 0000000000..cc8e2df2ad --- /dev/null +++ b/lookups/privileged_azure_ad_roles.yml @@ -0,0 +1,7 @@ +description: A list of privileged Azure Active Directory roles. +filename: privileged_azure_ad_roles.csv +name: privileged_azure_ad_roles +default_match: 'false' +match_type: WILDCARD(azureadrole) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file diff --git a/macros/azure_audit.yml b/macros/azure_audit.yml new file mode 100644 index 0000000000..80b295bfe4 --- /dev/null +++ b/macros/azure_audit.yml @@ -0,0 +1,4 @@ +definition: sourcetype=mscs:azure:audit +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: azure_audit diff --git a/stories/azure_active_directory_persistence.yml b/stories/azure_active_directory_persistence.yml new file mode 100644 index 0000000000..bdaef2f073 --- /dev/null +++ b/stories/azure_active_directory_persistence.yml @@ -0,0 +1,29 @@ +name: Azure Active Directory Persistence +id: dca983db-6334-4a0d-be32-80611ca1396c +version: 1 +date: '2022-08-17' +author: Mauricio Velazco, Splunk +description: Monitor for activities and techniques associated with the execution of Persistence + techniques against Azure Active Directory tenants. +narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure + services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. + According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ + Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. + This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants. + ' +references: +- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis +- https://azure.microsoft.com/en-us/services/active-directory/#overview +- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad +- https://attack.mitre.org/tactics/TA0003/ +- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/ + +tags: + analytic_story: Azure Active Directory Persistence + category: + - Cloud Security + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/cloud/azure_ad_external_guest_user_invited.test.yml b/tests/cloud/azure_ad_external_guest_user_invited.test.yml new file mode 100644 index 0000000000..9604be850d --- /dev/null +++ b/tests/cloud/azure_ad_external_guest_user_invited.test.yml @@ -0,0 +1,13 @@ +name: Azure AD External Guest User Invited Unit Test +tests: +- name: Azure AD External Guest User Invited + file: cloud/azure_ad_external_guest_user_invited.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_ad_global_administrator_role_assigned.test.yml b/tests/cloud/azure_ad_global_administrator_role_assigned.test.yml new file mode 100644 index 0000000000..11128d6839 --- /dev/null +++ b/tests/cloud/azure_ad_global_administrator_role_assigned.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Global Administrator Role Assigned Unit Test +tests: +- name: Azure AD Global Administrator Role Assigned + file: cloud/azure_ad_global_administrator_role_assigned.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_ad_new_custom_domain_added.test.yml b/tests/cloud/azure_ad_new_custom_domain_added.test.yml new file mode 100644 index 0000000000..60d0bd5a87 --- /dev/null +++ b/tests/cloud/azure_ad_new_custom_domain_added.test.yml @@ -0,0 +1,14 @@ +name: Azure AD New Custom Domain Added Unit Test +tests: +- name: Azure AD New Custom Domain Added + file: cloud/azure_ad_new_custom_domain_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true + diff --git a/tests/cloud/azure_ad_new_federated_domain_added.test.yml b/tests/cloud/azure_ad_new_federated_domain_added.test.yml new file mode 100644 index 0000000000..73770670ed --- /dev/null +++ b/tests/cloud/azure_ad_new_federated_domain_added.test.yml @@ -0,0 +1,14 @@ +name: Azure AD New Federated Domain Added Unit Test +tests: +- name: Azure AD New Federated Domain Added + file: cloud/azure_ad_new_federated_domain_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true + diff --git a/tests/cloud/azure_ad_privileged_role_assigned.test.yml b/tests/cloud/azure_ad_privileged_role_assigned.test.yml new file mode 100644 index 0000000000..79b8b4e37f --- /dev/null +++ b/tests/cloud/azure_ad_privileged_role_assigned.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Privileged Role Assigned Unit Test +tests: +- name: Azure AD Privileged Role Assigned + file: cloud/azure_ad_privileged_role_assigned.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_ad_service_principal_created.test.yml b/tests/cloud/azure_ad_service_principal_created.test.yml new file mode 100644 index 0000000000..64b312a62b --- /dev/null +++ b/tests/cloud/azure_ad_service_principal_created.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Service Principal Created Unit Test +tests: +- name: Azure AD Service Principal Created + file: cloud/azure_ad_service_principal_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_ad_service_principal_new_client_credentials.test.yml b/tests/cloud/azure_ad_service_principal_new_client_credentials.test.yml new file mode 100644 index 0000000000..0cab12d259 --- /dev/null +++ b/tests/cloud/azure_ad_service_principal_new_client_credentials.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Service Principal New Client Credentials Unit Test +tests: +- name: Azure AD Service Principal New Client Credentials + file: cloud/azure_ad_service_principal_new_client_credentials.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_ad_service_principal_owner_added.test.yml b/tests/cloud/azure_ad_service_principal_owner_added.test.yml new file mode 100644 index 0000000000..2ac9d93d67 --- /dev/null +++ b/tests/cloud/azure_ad_service_principal_owner_added.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Service Principal Owner Added Unit Test +tests: +- name: Azure AD Service Principal Owner Added + file: cloud/azure_ad_service_principal_owner_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_ad_user_enabled_and_password_reset.test.yml b/tests/cloud/azure_ad_user_enabled_and_password_reset.test.yml new file mode 100644 index 0000000000..b383797af3 --- /dev/null +++ b/tests/cloud/azure_ad_user_enabled_and_password_reset.test.yml @@ -0,0 +1,13 @@ +name: Azure AD User Enabled And Password Reset Unit Test +tests: +- name: Azure AD User Enabled And Password Reset + file: cloud/azure_ad_user_enabled_and_password_reset.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_enable_and_reset/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_ad_user_immutableid_attribute_updated.test.yml b/tests/cloud/azure_ad_user_immutableid_attribute_updated.test.yml new file mode 100644 index 0000000000..187516e21c --- /dev/null +++ b/tests/cloud/azure_ad_user_immutableid_attribute_updated.test.yml @@ -0,0 +1,13 @@ +name: Azure AD User ImmutableId Attribute Updated Unit Test +tests: +- name: Azure AD User ImmutableId Attribute Updated + file: cloud/azure_ad_user_immutableid_attribute_updated.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/tests/cloud/azure_automation_account_created.test.yml b/tests/cloud/azure_automation_account_created.test.yml new file mode 100644 index 0000000000..129e94582a --- /dev/null +++ b/tests/cloud/azure_automation_account_created.test.yml @@ -0,0 +1,13 @@ +name: Azure Automation Account Created Unit Test +tests: +- name: Azure Automation Account Created + file: cloud/azure_automation_account_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-activity.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity.log + source: mscs:azure:audit + sourcetype: mscs:azure:audit + update_timestamp: true diff --git a/tests/cloud/azure_automation_runbook_created.test.yml b/tests/cloud/azure_automation_runbook_created.test.yml new file mode 100644 index 0000000000..f290007034 --- /dev/null +++ b/tests/cloud/azure_automation_runbook_created.test.yml @@ -0,0 +1,13 @@ +name: Azure Automation Runbook Created Unit Test +tests: +- name: Azure Automation Runbook Created + file: cloud/azure_automation_runbook_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-activity.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity.log + source: mscs:azure:audit + sourcetype: mscs:azure:audit + update_timestamp: true diff --git a/tests/cloud/azure_runbook_webhook_created.test.yml b/tests/cloud/azure_runbook_webhook_created.test.yml new file mode 100644 index 0000000000..cae56c959d --- /dev/null +++ b/tests/cloud/azure_runbook_webhook_created.test.yml @@ -0,0 +1,13 @@ +name: Azure Runbook Webhook Created Unit Test +tests: +- name: Azure Runbook Webhook Created + file: cloud/azure_runbook_webhook_created.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-activity.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity.log + source: mscs:azure:audit + sourcetype: mscs:azure:audit + update_timestamp: true