From d159ca453ddb3f25cc38ee0f49b8ea813db2d084 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 20 Jun 2023 12:15:20 -0400 Subject: [PATCH] updating detection --- ..._users_failing_to_authenticate_from_ip.yml | 2 +- ...azure_ad_service_principal_owner_added.yml | 25 +++++++++++-------- ...mber_of_failed_authentications_from_ip.yml | 4 +-- 3 files changed, 17 insertions(+), 14 deletions(-) diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index bb6d43a3a8..a6ec1bd6f9 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -23,7 +23,7 @@ search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 proper | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment through and EventHub. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior. diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml index 6983a723ec..8ca29994fd 100644 --- a/detections/cloud/azure_ad_service_principal_owner_added.yml +++ b/detections/cloud/azure_ad_service_principal_owner_added.yml @@ -15,15 +15,18 @@ description: The following analytic identifies the addition of a new owner for a and obtain single-factor access to an Azure AD environment. Attackers who are looking to escalate their privileges by leveraging a Service Principals permissions may also add a new owner. data_source: [] -search: ' `azuread` body.operationName="Add owner to application" | rename body.properties.* - as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName - as newOwner | rename targetResources{}.modifiedProperties{}.newValue as displayName - | eval displayName = mvindex(displayName,1) | where initiatedBy!=newOwner | stats - values(displayName) by _time, initiatedBy, result, body.operationName, newOwner +search: ' `azuread` operationName="Add owner to application" + | rename properties.* as * + | rename initiatedBy.user.userPrincipalName as initiatedBy + | rename targetResources{}.userPrincipalName as newOwner + | rename targetResources{}.modifiedProperties{}.newValue as displayName + | eval displayName = mvindex(displayName,1) + | where initiatedBy!=newOwner + | stats values(displayName) by _time, initiatedBy, result, operationName, newOwner | `azure_ad_service_principal_owner_added_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the AuditLogs log category. known_false_positives: Administrator may legitimately add new owners for Service Principals. Filter as needed. @@ -54,11 +57,11 @@ tags: - Splunk Cloud required_fields: - _time - - body.operationName - - body.properties.initiatedBy.user.userPrincipalName - - body.properties.targetResources{}.userPrincipalName - - body.properties.targetResources{}.modifiedProperties{}.newValue - - body.propertiesresult + - operationName + - properties.initiatedBy.user.userPrincipalName + - properties.targetResources{}.userPrincipalName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.result risk_score: 54 security_domain: audit tests: diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 1b41270ae7..c82b0d584d 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -1,6 +1,6 @@ name: Azure AD Unusual Number of Failed Authentications From Ip id: 3d8d3a36-93b8-42d7-8d91-c5f24cec223d -version: 1 +version: 2 date: '2022-07-11' author: Mauricio Velazco, Splunk status: production @@ -32,7 +32,7 @@ search: ' `azuread` category=SignInLogs properties.status.errorCode=50126 proper | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). - You must be ingesting Azure Active Directory events into your Splunk environment through and EventHub. + You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. Specifically, this analytic leverages the SignInLogs log category. known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.