Skip to content

Azure Active Directory Account Takeover Analytic Story - #2278

Merged
patel-bhavin merged 56 commits into
developfrom
TR-2219_AzureAD_Password_Srapying
Jul 28, 2022
Merged

Azure Active Directory Account Takeover Analytic Story#2278
patel-bhavin merged 56 commits into
developfrom
TR-2219_AzureAD_Password_Srapying

Conversation

@mvelazc0

@mvelazc0 mvelazc0 commented Jul 7, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

New Analytic Stories

  • Azure Active Directory Account Takeover

New Detections

  • Azure AD Unusual Number of Failed Authentications From Ip
  • Azure Active Directory High Risk Sign-in
  • Azure AD Multiple Users Failing To Authenticate From Ip
  • Azure AD Successful Single-Factor Authentication
  • Azure AD Successful PowerShell Authentication
  • Azure AD Authentication Failed During MFA Challenge

New Detections

Author Checklist

  • Validate name matches <platform>_<mitre att&ck technique>_<short description>
  • Make sure that CI/CD detection-testing and build-and-validate jobs passed ✔️
  • Is there an Atomic Test? Is GUID on the test file under array: atomic_test_guid, example?

Review Checklist

  • Validated SPL logic.
  • Validated tags, description, and how to implement.
  • Verified references match analytic.

@auto-assign
auto-assign Bot requested a review from rosplk July 7, 2022 22:07
@mvelazc0 mvelazc0 changed the title Adding Azure AD Password Spraying Analytic Story Azure AD Password Spraying Analytic Story Jul 7, 2022
@patel-bhavin patel-bhavin added the WIP DO NOT MERGE Work in Progress label Jul 12, 2022
@mvelazc0 mvelazc0 changed the title Azure AD Password Spraying Analytic Story Azure Active Directory Account Takeover Analytic Story Jul 14, 2022
@josehelps josehelps removed the WIP DO NOT MERGE Work in Progress label Jul 26, 2022
@patel-bhavin
patel-bhavin enabled auto-merge July 28, 2022 21:32
@patel-bhavin
patel-bhavin merged commit 7bf7bfe into develop Jul 28, 2022
@delete-merged-branch
delete-merged-branch Bot deleted the TR-2219_AzureAD_Password_Srapying branch July 28, 2022 21:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@patel-bhavin patel-bhavin patel-bhavin approved these changes
@rosplk rosplk Awaiting requested review from rosplk rosplk is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@mvelazc0 @patel-bhavin @josehelps @pyth0n1c @MHaggis