admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

updating detection

Browse Source
This commit is contained in:
mvelazco
2023-06-20 12:15:20 -04:00
parent d92ac18e43
commit d159ca453d
3 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
+1 -1
View File
@@ -23,7 +23,7 @@ search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 proper
| `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
You must be ingesting Azure Active Directory events into your Splunk environment through and EventHub.
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
Specifically, this analytic leverages the SignInLogs log category.
known_false_positives: A source Ip failing to authenticate with multiple users is
not a common for legitimate behavior.
detections/cloud/azure_ad_service_principal_owner_added.yml
+14 -11
View File
@@ -15,15 +15,18 @@ description: The following analytic identifies the addition of a new owner for a
and obtain single-factor access to an Azure AD environment. Attackers who are looking to
escalate their privileges by leveraging a Service Principals permissions may also add a new owner.
data_source: []
search: ' `azuread` body.operationName="Add owner to application" | rename body.properties.*
as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName
as newOwner | rename targetResources{}.modifiedProperties{}.newValue as displayName
| eval displayName = mvindex(displayName,1) | where initiatedBy!=newOwner | stats
values(displayName) by _time, initiatedBy, result, body.operationName, newOwner
search: ' `azuread` operationName="Add owner to application"
| rename properties.* as *
| rename initiatedBy.user.userPrincipalName as initiatedBy
| rename targetResources{}.userPrincipalName as newOwner
| rename targetResources{}.modifiedProperties{}.newValue as displayName
| eval displayName = mvindex(displayName,1)
| where initiatedBy!=newOwner
| stats values(displayName) by _time, initiatedBy, result, operationName, newOwner
| `azure_ad_service_principal_owner_added_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
You must be ingesting Azure Active Directory events into your Splunk environment.
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: Administrator may legitimately add new owners for Service Principals.
Filter as needed.
@@ -54,11 +57,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- body.operationName
- body.properties.initiatedBy.user.userPrincipalName
- body.properties.targetResources{}.userPrincipalName
- body.properties.targetResources{}.modifiedProperties{}.newValue
- body.propertiesresult
- operationName
- properties.initiatedBy.user.userPrincipalName
- properties.targetResources{}.userPrincipalName
- properties.targetResources{}.modifiedProperties{}.newValue
- properties.result
risk_score: 54
security_domain: audit
tests:
detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+2 -2
View File
@@ -1,6 +1,6 @@
name: Azure AD Unusual Number of Failed Authentications From Ip
id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d
version: 1
version: 2
date: '2022-07-11'
author: Mauricio Velazco, Splunk
status: production
@@ -32,7 +32,7 @@ search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 proper
| `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
You must be ingesting Azure Active Directory events into your Splunk environment through and EventHub.
You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
Specifically, this analytic leverages the SignInLogs log category.
known_false_positives: A source Ip failing to authenticate with multiple users is
not a common for legitimate behavior.