Skip to content

Commit 1653183

Browse files
terrancedejesusterrancedejesus
authored
[New Rule] Entra ID Protection Admin Confirmed Compromise (#5186)
*Issue link(s)*: * #5185 <!-- Add Related Issues / PRs for context. Eg: Related to elastic/repo#999 Resolves #123 If there is no issue link, take extra care to write a clear summary and label the PR just as you would label an issue to give additional context to reviewers. --> ## Summary - What I changed Adds a specific detection rule for admin confirmed compromise by Entra ID protection. Relates to BBR rule `Microsoft Entra ID Protection - Risk Detections`. Please see related issue for more details. <!-- Summarize your PR. Animated gifs are 💯. Code snippets are ⚡️. Examples & screenshots are 🔥 --> ## How To Test Query can be used in TRADE serverless stack. <!-- Some examples of what you could include here are: * Links to GitHub action results for CI test improvements * Sample data before/after screenshots (or short videos showing how something works) * Copy/pasted commands and output from the testing you did in your local terminal window * If tests run in GitHub, you can 🪁or 🔱, respectively, to indicate tests will run in CI * Query used in your stack to verify the change --> ## Checklist <!-- Delete any items that are not applicable to this PR. --> - [ ] Added a label for the type of pr: `bug`, `enhancement`, `schema`, `maintenance`, `Rule: New`, `Rule: Deprecation`, `Rule: Tuning`, `Hunt: New`, or `Hunt: Tuning` so guidelines can be generated - [ ] Added the `meta:rapid-merge` label if planning to merge within 24 hours - [ ] Secret and sensitive material has been managed correctly - [ ] Automated testing was updated or added to match the most common scenarios - [ ] Documentation and comments were added for features that require explanation ## Contributor checklist - Have you signed the [contributor license agreement](https://www.elastic.co/contributor-agreement)? - Have you followed the [contributor guidelines](https://github.com/elastic/detection-rules/blob/main/CONTRIBUTING.md)?
1 parent 5512520 commit 1653183

File tree

1 file changed

+146
-0
lines changed

1 file changed

+146
-0
lines changed

‎rules/integrations/azure/initial_access_entra_id_protection_confirmed_compromise.toml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
[metadata]
2+
creation_date = "2025/10/06"
3+
integration = ["azure"]
4+
maturity = "production"
5+
updated_date = "2025/10/06"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when an administrator has manually confirmed a user or sign-in as compromised in Microsoft Entra ID
11+
Protection. This indicates that an administrator has reviewed the risk detection and determined that the user account or
12+
sign-in activity is definitively compromised. This is a high-confidence indicator of account compromise and should be
13+
investigated immediately.
14+
"""
15+
false_positives = [
16+
"""
17+
Administrators may mark accounts as compromised during security testing or incident response exercises. If this is
18+
expected behavior in your environment, consider adjusting the rule or adding exceptions for specific test accounts.
19+
""",
20+
]
21+
from = "now-9m"
22+
index = ["logs-azure.identity_protection-*"]
23+
language = "kuery"
24+
license = "Elastic License v2"
25+
name = "Entra ID Protection Admin Confirmed Compromise"
26+
note = """## Triage and analysis
27+
28+
This rule detects when an administrator has manually confirmed a user or sign-in as compromised in Microsoft Entra ID Protection. This is a critical security event that requires immediate investigation and response.
29+
30+
### Possible investigation steps
31+
32+
- Review the `azure.identityprotection.properties.risk_detail` field to determine if the compromise was confirmed at the sign-in level (`adminConfirmedSigninCompromised`) or user level (`adminConfirmedUserCompromised`).
33+
- Check the `azure.identityprotection.properties.user_principal_name` field to identify the compromised user account.
34+
- Review the `azure.identityprotection.properties.user_display_name` field for additional user identification information.
35+
- Examine the `azure.identityprotection.properties.risk_level` field to understand the severity level assigned to the risk event.
36+
- Check the `azure.identityprotection.properties.risk_state` field to verify the current state of the risk (should be confirmed as compromised).
37+
- Review the `azure.correlation_id` field to correlate this event with other related security events, including the original risk detections that led to the admin confirmation.
38+
- Investigate the timeline of events leading up to the admin confirmation by reviewing Entra ID sign-in logs and audit logs for the affected user.
39+
- Check for any suspicious activities associated with the user account, including:
40+
- Unusual sign-in locations or IP addresses
41+
- Access to sensitive resources or applications
42+
- Changes to user profile, permissions, or MFA settings
43+
- Bulk email sending or data exfiltration activities
44+
- Review the `azure.identityprotection.properties.additional_info` field for any additional context provided by the administrator or Entra ID Protection.
45+
- Identify which administrator confirmed the compromise by reviewing Entra ID audit logs for risk state changes.
46+
47+
### False positive analysis
48+
49+
- Security testing or penetration testing exercises may result in administrators confirming test accounts as compromised. If this is expected behavior, consider excluding specific test accounts or implementing a testing account naming convention to filter.
50+
- Incident response drills or tabletop exercises may involve marking accounts as compromised for training purposes. Coordinate with security teams to identify planned exercises.
51+
52+
### Response and remediation
53+
54+
- Immediately reset the password for the compromised user account and require the user to set a new password upon next sign-in.
55+
- Revoke all active sessions and authentication tokens for the compromised account, including:
56+
- Primary refresh tokens (PRTs)
57+
- OAuth tokens
58+
- Session cookies
59+
- Application-specific passwords
60+
- Review and revoke any suspicious OAuth consent grants or application permissions added by the compromised account.
61+
- Enable or enforce multi-factor authentication (MFA) for the affected user account if not already enabled.
62+
- Review all activities performed by the compromised account, including:
63+
- Email forwarding rules or inbox rules
64+
- File access and downloads
65+
- Changes to security settings or permissions
66+
- Creation of new users or service principals
67+
- Assess the scope of the compromise by identifying any lateral movement or privilege escalation activities.
68+
- Consider disabling the account temporarily until the investigation is complete and all remediation steps are verified.
69+
- Implement conditional access policies to prevent future compromises, such as requiring MFA from untrusted locations or blocking legacy authentication.
70+
- Review and strengthen identity protection policies and risk-based conditional access rules.
71+
- Document the incident, including the timeline, scope of compromise, and remediation actions taken.
72+
- Conduct a post-incident review to identify gaps in security controls and implement improvements to prevent similar incidents.
73+
"""
74+
references = [
75+
"https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk",
76+
"https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks",
77+
"https://learn.microsoft.com/en-us/graph/api/resources/riskdetection",
78+
]
79+
risk_score = 99
80+
rule_id = "a1b2c3d4-e5f6-7890-a1b2-c3d4e5f67890"
81+
setup = """#### Required Microsoft Entra ID Protection Logs
82+
To use this rule, ensure that Microsoft Entra ID Protection logs are being collected and streamed into the Elastic Stack via the Azure integration.
83+
"""
84+
severity = "critical"
85+
tags = [
86+
"Domain: Cloud",
87+
"Domain: Identity",
88+
"Data Source: Azure",
89+
"Data Source: Entra ID",
90+
"Data Source: Entra ID Protection Logs",
91+
"Use Case: Identity and Access Audit",
92+
"Use Case: Threat Detection",
93+
"Tactic: Initial Access",
94+
"Resources: Investigation Guide",
95+
]
96+
timestamp_override = "event.ingested"
97+
type = "query"
98+
99+
query = '''
100+
event.dataset: azure.identity_protection and
101+
azure.identityprotection.properties.risk_detail: (
102+
"adminConfirmedSigninCompromised" or
103+
"adminConfirmedUserCompromised"
104+
)
105+
'''
106+
107+
108+
[[rule.threat]]
109+
framework = "MITRE ATT&CK"
110+
[[rule.threat.technique]]
111+
id = "T1078"
112+
name = "Valid Accounts"
113+
reference = "https://attack.mitre.org/techniques/T1078/"
114+
[[rule.threat.technique.subtechnique]]
115+
id = "T1078.004"
116+
name = "Cloud Accounts"
117+
reference = "https://attack.mitre.org/techniques/T1078/004/"
118+
119+
120+
121+
[rule.threat.tactic]
122+
id = "TA0001"
123+
name = "Initial Access"
124+
reference = "https://attack.mitre.org/tactics/TA0001/"
125+
126+
[rule.investigation_fields]
127+
field_names = [
128+
"@timestamp",
129+
"event.action",
130+
"azure.identityprotection.properties.risk_detail",
131+
"azure.identityprotection.properties.risk_level",
132+
"azure.identityprotection.properties.risk_state",
133+
"azure.identityprotection.properties.risk_event_type",
134+
"azure.identityprotection.properties.risk_type",
135+
"azure.identityprotection.properties.user_principal_name",
136+
"azure.identityprotection.properties.user_display_name",
137+
"azure.identityprotection.properties.user_id",
138+
"azure.identityprotection.properties.ip_address",
139+
"azure.identityprotection.properties.activity",
140+
"azure.identityprotection.properties.additional_info",
141+
"azure.identityprotection.properties.correlation_id",
142+
"azure.correlation_id",
143+
"source.ip",
144+
]
145+
146+

0 commit comments

Comments
 (0)