adding new detection. other minor changes

detections/cloud/azure_ad_automation_account_created.yml

@@ -0,0 +1,53 @@
+name: Azure AD Automation Account Created
+id: 860902fd-2e76-46b3-b050-ba548dab576c
+version: 1
+date: '2022-08-18'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: UPDATE_DESCRIPTION
+search: ' `azuread`
+  
+  | `azure_ad_automation_account_created_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. 
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Administrators may legitimately create Azure Automation accounts. Filter as needed.
+references:
+- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
+- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
+tags:
+  analytic_story:
+  - Azure Active Directory Persistence
+   asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Update context
+  dataset:
+  - UPDATE_DATASET_URL
+  impact: 70
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: UPDATE message
+  mitre_attack_id:
+  - T1003.002
+  nist:
+  - DE.CM
+  observable:
+  - name: UPDATE
+    type: UPDATE
+    role:
+    - UPDATE
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 63
+  security_domain: audit

detections/cloud/azure_ad_global_administrator_role_assigned.yml

@@ -7,6 +7,7 @@ type: TTP
 datamodel: []
 description: The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. 
   The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment.
+  While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources.
   Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
 search: '`azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global Administrator\"" 
   | rename body.properties.* as * 
@@ -17,12 +18,13 @@ search: '`azuread` "body.operationName"="Add member to role"  "body.properties.t
   | `azure_ad_global_administrator_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. 
   Specifically, this analytic leverages the AuditLogs log category.
-known_false_positives: Although rare, Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
+known_false_positives: Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
 references:
 - https://o365blog.com/post/admin/
 - https://adsecurity.org/?p=4277
 - https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
 - https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning
+- https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
 - https://attack.mitre.org/techniques/T1098/003/
 tags:
   analytic_story:

detections/cloud/azure_ad_service_principal_created.yml

@@ -6,9 +6,9 @@ author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: The following analytic identifies the creation of a Service Principal in an Azure AD environment.
-  An Azure Service Principal is an identity designed for use with apps, services, and automated tools to access resources. 
+  An Azure Service Principal is an identity designed for use with apps, services, and automated tools to access resources. Service Principal authentication does not support multi-factor authentication.
   This access is restricted by the roles assigned to the Service Principal, giving users control over which resources can be accessed and at which level.
-  Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence in the Azure AD environment.
+  Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
 search: '`azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=*   
   | rename body.properties.* as * 
   | rename targetResources{}.displayName as displayName 
@@ -23,6 +23,7 @@ references:
 - https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
 - https://docs.microsoft.com/en-us/powershell/azure/create-azure-service-principal-azureps?view=azps-8.2.0
 - https://www.truesec.com/hub/blog/using-a-legitimate-application-to-create-persistence-and-initiate-email-campaigns
+- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
 - https://attack.mitre.org/techniques/T1136/003/
 tags:
   analytic_story:

detections/cloud/azure_ad_service_principal_new_client_credentials.yml

@@ -22,6 +22,7 @@ references:
 - https://attack.mitre.org/techniques/T1098/001/
 - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501-2/
 - https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/
+- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
 tags:
   analytic_story:
   - Azure Active Directory Persistence

tests/cloud/azure_ad_automation_account_created.test.yml

@@ -0,0 +1,13 @@
+name: Azure AD Automation Account Created Unit Test
+tests:
+- name: Azure AD Automation Account Created
+  file: cloud/azure_ad_automation_account_created.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: UPDATE
+    data: UPDATE
+    source: UPDATE
+    sourcetype: UPDATE
+    update_timestamp: true