mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
75 lines
3.1 KiB
YAML
75 lines
3.1 KiB
YAML
name: Azure Runbook Webhook Created
|
|
id: e98944a9-92e4-443c-81b8-a322e33ce75a
|
|
version: 4
|
|
date: '2024-05-23'
|
|
author: Mauricio Velazco, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic detects the creation of a new Automation Runbook
|
|
Webhook within an Azure tenant. It leverages Azure Audit events, specifically the
|
|
"Create or Update an Azure Automation webhook" operation, to identify this activity.
|
|
This behavior is significant because Webhooks can trigger Automation Runbooks via
|
|
unauthenticated URLs exposed to the Internet, posing a security risk. If confirmed
|
|
malicious, an attacker could use this to execute code, create users, or maintain
|
|
persistence within the environment, potentially leading to unauthorized access and
|
|
control over Azure resources.
|
|
data_source:
|
|
- Azure Audit Create or Update an Azure Automation webhook
|
|
search: ' `azure_audit` operationName.localizedValue="Create or Update an Azure Automation
|
|
webhook" status.value=Succeeded | dedup object | rename claims.ipaddr as src_ip
|
|
| rename caller as user | stats count min(_time) as firstTime max(_time) as lastTime
|
|
by object user, src_ip, resourceGroupName, object_path | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `azure_runbook_webhook_created_filter`'
|
|
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
|
|
Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
|
|
You must be ingesting Azure Audit events into your Splunk environment. Specifically,
|
|
this analytic leverages the Azure Activity log category.
|
|
known_false_positives: Administrators may legitimately create Azure Runbook Webhooks.
|
|
Filter as needed.
|
|
references:
|
|
- https://docs.microsoft.com/en-us/azure/automation/overview
|
|
- https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
|
|
- https://docs.microsoft.com/en-us/azure/automation/automation-webhooks?tabs=portal
|
|
- https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
|
|
- https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
|
|
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
|
|
- https://attack.mitre.org/techniques/T1078/004/
|
|
tags:
|
|
analytic_story:
|
|
- Azure Active Directory Persistence
|
|
asset_type: Azure Tenant
|
|
confidence: 90
|
|
impact: 70
|
|
message: A new Azure Runbook Webhook $object$ was created by $user$
|
|
mitre_attack_id:
|
|
- T1078
|
|
- T1078.004
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- operationName.localizedValue
|
|
- status.value
|
|
- object
|
|
- caller
|
|
- claims.ipaddr
|
|
- resourceGroupName
|
|
- object_path
|
|
risk_score: 63
|
|
security_domain: threat
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity.log
|
|
source: mscs:azure:audit
|
|
sourcetype: mscs:azure:audit
|
|
update_timestamp: true
|