mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
mvelazco
30 lines
1.7 KiB
YAML
30 lines
1.7 KiB
YAML
name: Azure Active Directory Persistence
|
|
id: dca983db-6334-4a0d-be32-80611ca1396c
|
|
version: 1
|
|
date: '2022-08-17'
|
|
author: Mauricio Velazco, Splunk
|
|
description: Monitor for activities and techniques associated with the execution of Persistence
|
|
techniques against Azure Active Directory tenants.
|
|
narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure
|
|
services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol.
|
|
According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\
|
|
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access.
|
|
This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants.
|
|
'
|
|
references:
|
|
- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis
|
|
- https://azure.microsoft.com/en-us/services/active-directory/#overview
|
|
- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad
|
|
- https://attack.mitre.org/tactics/TA0003/
|
|
- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/
|
|
|
|
tags:
|
|
analytic_story: Azure Active Directory Persistence
|
|
category:
|
|
- Cloud Security
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|