security_content/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml at develop · Elmo-Riyani/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: Azure AD Multi-Factor Authentication Disabled
id: 482dd42a-acfa-486b-a0bb-d6fcda27318e
version: 1
date: '2022-08-10'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic identifies an attempt to disable multi-factor
  authentication for an Azure AD user. An adversary who has obtained access to an
  Azure AD tenant may disable multi-factor authentication as a way to plant a backdoor
  and maintain persistence using a valid account. This way the attackers can keep
  persistance in the environment without adding new users.
data_source: []
search: '`azuread` category=AuditLogs operationName="Disable Strong Authentication"
  | rename properties.* as * | rename targetResources{}.userPrincipalName as
  userPrincipalName | rename targetResources{}.type as type | rename initiatedBy.user.userPrincipalName
  as initiatedBy | stats values(userPrincipalName) as userPrincipalName by _time, type, operationName,
  initiatedBy, result | `azure_ad_multi_factor_authentication_disabled_filter`'
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
  You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
  Specifically, this analytic leverages the AuditLogs log category.
known_false_positives: Legitimate use case may require for users to disable MFA. Filter
  as needed.
references:
- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
- https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/techniques/T1556/
tags:
  analytic_story:
  - Azure Active Directory Account Takeover
  asset_type: Azure Active Directory
  confidence: 90
  impact: 50
  message: MFA disabled for User $userPrincipalName$ initiated by $initiatedBy$
  mitre_attack_id:
  - T1586
  - T1586.003
  - T1556
  - T1556.006
  observable:
  - name: userPrincipalName
    type: User
    role:
    - Victim
  - name: initiatedBy
    type: User
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - properties.targetResources{}.userPrincipalName
  - properties.targetResources{}.type
  - properties.initiatedBy.user.userPrincipalName
  - properties.result
  risk_score: 45
  security_domain: identity
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/azuread/azure-audit.log
    source: mscs:azure:eventhub
    sourcetype: mscs:azure:eventhub
    update_timestamp: true