Azure Active Directory Account Takeover Analytic Story

detections/cloud/azure_active_directory_high_risk_sign_in.yml

@@ -0,0 +1,68 @@
+name: Azure Active Directory High Risk Sign-in
+id: 1ecff169-26d7-4161-9a7b-2ac4c8e61bea
+version: 1
+date: '2022-07-11'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic triggers on a high risk sign-in against Azure Active Directory identified by Azure Identity Protection. Identity Protection monitors sign-in events
+  using heuristics and machine learning to identify potentially malicious events and categorizes them in three categories high, medium and low.'
+search: ' `azuread` body.category=UserRiskEvents body.properties.riskLevel=high 
+  | rename body.properties.* as *
+  |  stats values(userPrincipalName) by _time, ipAddress, activity, riskLevel, riskEventType, additionalInfo
+  | `azure_active_directory_high_risk_sign_in_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents
+  log category.
+known_false_positives: Details for the risk calculation algorithm used by Identity Protection are unknown and may be prone to false positives.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
+- https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
+- https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$
+  mitre_attack_id:
+  - T1110
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.category
+  - body.properties.riskLevel
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.activity
+  - body.properties.riskEventType
+  - body.properties.additionalInfo
+  risk_score: 54
+  security_domain: identity

detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml

@@ -0,0 +1,69 @@
+name: Azure AD Authentication Failed During MFA Challenge
+id: e62c9c2e-bf51-4719-906c-3074618fcc1c
+version: 1
+date: '2022-07-14'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary
+  trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages,
+  and phone calls, potentially resulting in the user finally accepting the authentication request.'
+search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=500121
+  | rename body.properties.* as *
+  | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent
+  | `azure_ad_authentication_failed_during_mfa_challenge_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents
+  log category.
+known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
+references:
+- https://attack.mitre.org/techniques/T1621/ 
+- https://attack.mitre.org/techniques/T1078/004/
+- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1621/azuread/azure-audit.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: User $body.properties.userPrincipalName$ failed to pass MFA challenge
+  mitre_attack_id:
+  - T1078
+  - T1078.004
+  - T1621
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.category
+  - body.properties.status.errorCode
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.status.additionalDetails
+  - body.properties.appDisplayName
+  - body.properties.userAgent
+  risk_score: 54
+  security_domain: identity

detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml

@@ -0,0 +1,72 @@
+name: Azure AD Multiple Users Failing To Authenticate From Ip
+id: 94481a6a-8f59-4c86-957f-55a71e3612a6
+version: 1
+date: '2022-07-12'
+author: Mauricio Velazco, Splunk
+type: Anomaly
+datamodel: []
+description: 'The following analytic identifies one source Ip failing to authenticate with 30 unique valid users within 5 minutes. This behavior could 
+  represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code
+  50126 represents an invalid password. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+  Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.'
+
+search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false 
+  | rename body.properties.* as *
+  | bucket span=5m _time
+  | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
+  | where unique_accounts > 30
+  | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
+- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
+- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users within 5 minutes.
+  mitre_attack_id:
+  - T1110
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.status.errorCode
+  - body.category
+  - body.properties.authenticationDetails
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  risk_score: 63
+  security_domain: identity

detections/cloud/azure_ad_successful_powershell_authentication.yml

@@ -0,0 +1,68 @@
+name: Azure AD Successful PowerShell Authentication
+id: 62f10052-d7b3-4e48-b57b-56f8e3ac7ceb
+version: 1
+date: '2022-07-13'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. This behavior is not common for regular,
+ non administrative users. After compromising an account in Azure AD, attackers and red teams  alike will perform enumeration and discovery techniques. 
+ One method of executing these techniques is leveraging the native PowerShell modules.'
+search: ' `azuread` body.category=SignInLogs body.properties.authenticationDetails{}.succeeded=true body.properties.appDisplayName="Azure Active Directory PowerShell"
+  | rename body.properties.* as *
+  |  stats values(userPrincipalName) by _time, ipAddress, appDisplayName, userAgent
+  | `azure_ad_successful_powershell_authentication_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1078/004/
+- https://docs.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0
+- https://securitycafe.ro/2022/04/29/pentesting-azure-recon-techniques/
+- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest.md 
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread_pws/azure-audit.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Successful authentication for user $body.properties.userPrincipalName$ using PowerShell.
+  mitre_attack_id:
+  - T1078
+  - T1078.004
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.appDisplayName
+  - body.category
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.appDisplayName
+  - body.properties.userAgent
+  risk_score: 54
+  security_domain: identity

detections/cloud/azure_ad_successful_single_factor_authentication.yml

@@ -0,0 +1,65 @@
+name: Azure AD Successful Single-Factor Authentication
+id: a560e7f6-1711-4353-885b-40be53101fcd
+version: 1
+date: '2022-07-12'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: 'The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication 
+  enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated'
+search: ' `azuread`  body.category=SignInLogs body.properties.authenticationRequirement=singleFactorAuthentication body.properties.authenticationDetails{}.succeeded=true
+  | rename body.properties.* as *
+  |  stats values(userPrincipalName) by _time, ipAddress, appDisplayName, authenticationRequirement
+  | `azure_ad_successful_single_factor_authentication_filter`'
+how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
+references:
+- https://attack.mitre.org/techniques/T1078/004/
+- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks*
+- https://www.forbes.com/sites/daveywinder/2020/07/08/new-dark-web-audit-reveals-15-billion-stolen-logins-from-100000-breaches-passwords-hackers-cybercrime/?sh=69927b2a180f
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.004/azuread/azure-audit.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: Successful authentication for user $body.properties.userPrincipalName$ without MFA
+  mitre_attack_id:
+  - T1003.002
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.category
+  - body.properties.authenticationRequirement
+  - body.properties.authenticationDetails
+  - body.properties.userPrincipalName
+  - body.properties.ipAddress
+  - body.properties.appDisplayName
+  risk_score: 50
+  security_domain: identity