From d6dd5098bee3ae00a0e3fdea5c93e9528b2442e8 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Thu, 14 Jul 2022 13:29:55 -0400
Subject: [PATCH] adding new detection

---
 ...entication_failed_during_mfa_challenge.yml | 68 +++++++++++++++++++
 ...ation_failed_during_mfa_challenge.test.yml | 13 ++++
 2 files changed, 81 insertions(+)
 create mode 100644 detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
 create mode 100644 tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml

diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
new file mode 100644
index 0000000000..e98e632057
--- /dev/null
+++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
@@ -0,0 +1,68 @@
+name: Azure AD Authentication Failed During MFA Challenge
+id: e62c9c2e-bf51-4719-906c-3074618fcc1c
+version: 1
+date: '2022-07-14'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary
+  trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages,
+  and phone calls, potentially resulting in the user finally accepting the authentication request.'
+search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
+  | stats values(body.properties.userPrincipalName) by _time, body.properties.ipAddress, body.properties.status.additionalDetails, body.properties.appDisplayName, body.properties.userAgent
+  | `azure_ad_authentication_failed_during_mfa_challenge_filter`'
+how_to_implement: You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents
+  log category.
+known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
+references:
+- https://attack.mitre.org/techniques/T1621/ 
+- https://attack.mitre.org/techniques/T1078/004/
+- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
+tags:
+  analytic_story:
+  - Azure Active Directory Password Spraying
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/azuread/azure-audit.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: User $body.properties.userPrincipalName$ failed to pass MFA challenge
+  mitre_attack_id:
+  - T1078
+  - T1078.004
+  - T1621
+  nist:
+  - DE.CM
+  observable:
+  - name: body.properties.userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: body.properties.ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.category
+  - body.properties.status.errorCode
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.status.additionalDetails
+  - body.properties.appDisplayName
+  - body.properties.userAgent
+  risk_score: 54
+  security_domain: identity
diff --git a/tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml b/tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml
new file mode 100644
index 0000000000..eca12c0ab3
--- /dev/null
+++ b/tests/cloud/azure_ad_authentication_failed_during_mfa_challenge.test.yml
@@ -0,0 +1,13 @@
+name: Azure AD Authentication Failed During MFA Challenge Unit Test
+tests:
+- name: Azure AD Authentication Failed During MFA Challenge
+  file: cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azure-audit.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/azuread/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true