Skip to content

Commit 0110179

Browse files
terrancedejesusterrancedejesus
authored
Merge branch 'main' into terrancedejesus/issue5189
2 parents 62b757c + a3cb002 commit 0110179

File tree

2 files changed

+149
-3
lines changed

2 files changed

+149
-3
lines changed

‎rules/integrations/azure/initial_access_entra_id_protection_confirmed_compromise.toml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
[metadata]
2+
creation_date = "2025/10/06"
3+
integration = ["azure"]
4+
maturity = "production"
5+
updated_date = "2025/10/06"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when an administrator has manually confirmed a user or sign-in as compromised in Microsoft Entra ID
11+
Protection. This indicates that an administrator has reviewed the risk detection and determined that the user account or
12+
sign-in activity is definitively compromised. This is a high-confidence indicator of account compromise and should be
13+
investigated immediately.
14+
"""
15+
false_positives = [
16+
"""
17+
Administrators may mark accounts as compromised during security testing or incident response exercises. If this is
18+
expected behavior in your environment, consider adjusting the rule or adding exceptions for specific test accounts.
19+
""",
20+
]
21+
from = "now-9m"
22+
index = ["logs-azure.identity_protection-*"]
23+
language = "kuery"
24+
license = "Elastic License v2"
25+
name = "Entra ID Protection Admin Confirmed Compromise"
26+
note = """## Triage and analysis
27+
28+
This rule detects when an administrator has manually confirmed a user or sign-in as compromised in Microsoft Entra ID Protection. This is a critical security event that requires immediate investigation and response.
29+
30+
### Possible investigation steps
31+
32+
- Review the `azure.identityprotection.properties.risk_detail` field to determine if the compromise was confirmed at the sign-in level (`adminConfirmedSigninCompromised`) or user level (`adminConfirmedUserCompromised`).
33+
- Check the `azure.identityprotection.properties.user_principal_name` field to identify the compromised user account.
34+
- Review the `azure.identityprotection.properties.user_display_name` field for additional user identification information.
35+
- Examine the `azure.identityprotection.properties.risk_level` field to understand the severity level assigned to the risk event.
36+
- Check the `azure.identityprotection.properties.risk_state` field to verify the current state of the risk (should be confirmed as compromised).
37+
- Review the `azure.correlation_id` field to correlate this event with other related security events, including the original risk detections that led to the admin confirmation.
38+
- Investigate the timeline of events leading up to the admin confirmation by reviewing Entra ID sign-in logs and audit logs for the affected user.
39+
- Check for any suspicious activities associated with the user account, including:
40+
- Unusual sign-in locations or IP addresses
41+
- Access to sensitive resources or applications
42+
- Changes to user profile, permissions, or MFA settings
43+
- Bulk email sending or data exfiltration activities
44+
- Review the `azure.identityprotection.properties.additional_info` field for any additional context provided by the administrator or Entra ID Protection.
45+
- Identify which administrator confirmed the compromise by reviewing Entra ID audit logs for risk state changes.
46+
47+
### False positive analysis
48+
49+
- Security testing or penetration testing exercises may result in administrators confirming test accounts as compromised. If this is expected behavior, consider excluding specific test accounts or implementing a testing account naming convention to filter.
50+
- Incident response drills or tabletop exercises may involve marking accounts as compromised for training purposes. Coordinate with security teams to identify planned exercises.
51+
52+
### Response and remediation
53+
54+
- Immediately reset the password for the compromised user account and require the user to set a new password upon next sign-in.
55+
- Revoke all active sessions and authentication tokens for the compromised account, including:
56+
- Primary refresh tokens (PRTs)
57+
- OAuth tokens
58+
- Session cookies
59+
- Application-specific passwords
60+
- Review and revoke any suspicious OAuth consent grants or application permissions added by the compromised account.
61+
- Enable or enforce multi-factor authentication (MFA) for the affected user account if not already enabled.
62+
- Review all activities performed by the compromised account, including:
63+
- Email forwarding rules or inbox rules
64+
- File access and downloads
65+
- Changes to security settings or permissions
66+
- Creation of new users or service principals
67+
- Assess the scope of the compromise by identifying any lateral movement or privilege escalation activities.
68+
- Consider disabling the account temporarily until the investigation is complete and all remediation steps are verified.
69+
- Implement conditional access policies to prevent future compromises, such as requiring MFA from untrusted locations or blocking legacy authentication.
70+
- Review and strengthen identity protection policies and risk-based conditional access rules.
71+
- Document the incident, including the timeline, scope of compromise, and remediation actions taken.
72+
- Conduct a post-incident review to identify gaps in security controls and implement improvements to prevent similar incidents.
73+
"""
74+
references = [
75+
"https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk",
76+
"https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks",
77+
"https://learn.microsoft.com/en-us/graph/api/resources/riskdetection",
78+
]
79+
risk_score = 99
80+
rule_id = "a1b2c3d4-e5f6-7890-a1b2-c3d4e5f67890"
81+
setup = """#### Required Microsoft Entra ID Protection Logs
82+
To use this rule, ensure that Microsoft Entra ID Protection logs are being collected and streamed into the Elastic Stack via the Azure integration.
83+
"""
84+
severity = "critical"
85+
tags = [
86+
"Domain: Cloud",
87+
"Domain: Identity",
88+
"Data Source: Azure",
89+
"Data Source: Entra ID",
90+
"Data Source: Entra ID Protection Logs",
91+
"Use Case: Identity and Access Audit",
92+
"Use Case: Threat Detection",
93+
"Tactic: Initial Access",
94+
"Resources: Investigation Guide",
95+
]
96+
timestamp_override = "event.ingested"
97+
type = "query"
98+
99+
query = '''
100+
event.dataset: azure.identity_protection and
101+
azure.identityprotection.properties.risk_detail: (
102+
"adminConfirmedSigninCompromised" or
103+
"adminConfirmedUserCompromised"
104+
)
105+
'''
106+
107+
108+
[[rule.threat]]
109+
framework = "MITRE ATT&CK"
110+
[[rule.threat.technique]]
111+
id = "T1078"
112+
name = "Valid Accounts"
113+
reference = "https://attack.mitre.org/techniques/T1078/"
114+
[[rule.threat.technique.subtechnique]]
115+
id = "T1078.004"
116+
name = "Cloud Accounts"
117+
reference = "https://attack.mitre.org/techniques/T1078/004/"
118+
119+
120+
121+
[rule.threat.tactic]
122+
id = "TA0001"
123+
name = "Initial Access"
124+
reference = "https://attack.mitre.org/tactics/TA0001/"
125+
126+
[rule.investigation_fields]
127+
field_names = [
128+
"@timestamp",
129+
"event.action",
130+
"azure.identityprotection.properties.risk_detail",
131+
"azure.identityprotection.properties.risk_level",
132+
"azure.identityprotection.properties.risk_state",
133+
"azure.identityprotection.properties.risk_event_type",
134+
"azure.identityprotection.properties.risk_type",
135+
"azure.identityprotection.properties.user_principal_name",
136+
"azure.identityprotection.properties.user_display_name",
137+
"azure.identityprotection.properties.user_id",
138+
"azure.identityprotection.properties.ip_address",
139+
"azure.identityprotection.properties.activity",
140+
"azure.identityprotection.properties.additional_info",
141+
"azure.identityprotection.properties.correlation_id",
142+
"azure.correlation_id",
143+
"source.ip",
144+
]
145+
146+

‎rules/linux/privilege_escalation_cve_2025_32463_sudo_chroot_execution.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/10/01"
33
integration = ["endpoint", "auditd_manager", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/10/01"
5+
updated_date = "2025/10/15"
66

77
[rule]
88
author = ["Elastic"]
@@ -38,7 +38,7 @@ This rule highlights sudo invoked with the chroot (-R/--chroot) option outside n
3838
- Extract the chroot target path from the event and enumerate its etc and lib directories for attacker-seeded NSS artifacts (nsswitch.conf, libnss_*, ld.so.preload) and fake passwd/group files, noting recent mtime, ownership, and world-writable files.
3939
- Pivot to file-creation and modification telemetry to identify processes and users that populated that path shortly before execution (e.g., curl, wget, tar, git, gcc), linking them to the invoking user to establish intent.
4040
- Review session and process details to see if a shell or interpreter was launched inside the chroot and whether an euid transition to 0 occurred, indicating a successful privilege escalation.
41-
- Confirm sudo’s package version and build options and the user’s sudoers policy (secure_path/env_* settings and any NOPASSWD allowances) to assess exploitability and whether chroot usage was authorized.
41+
- Confirm sudo's package version and build options and the user’s sudoers policy (secure_path/env_* settings and any NOPASSWD allowances) to assess exploitability and whether chroot usage was authorized.
4242
- Collect and preserve the chroot directory contents and relevant audit/log artifacts, and scope by searching for similar chroot invocations or NSS file seeds across the host and fleet.
4343
4444
### False positive analysis
@@ -105,7 +105,7 @@ type = "eql"
105105
query = '''
106106
process where host.os.type == "linux" and event.type == "start" and
107107
event.action in ("exec", "exec_event", "start", "executed", "process_started", "ProcessRollup2") and
108-
process.name == "sudo" and process.args in ("-R", "--chroot") and
108+
process.name == "sudo" and process.args like ("-R", "--chroot*") and
109109
// To enforce the -R and --chroot arguments to be for sudo specifically, while wildcarding potential full sudo paths
110110
process.command_line like ("*sudo -R*", "*sudo --chroot*")
111111
'''

0 commit comments

Comments
 (0)