Skip to content

Commit 4a8b59d

Browse files
terrancedejesustradebot-elastic
terrancedejesus
authored and
tradebot-elastic
committed
[New Rule] Entra ID Actor Token User Impersonation Abuse (#5136)
* Adding rule 'Entra ID Actor Token User Impersonation Abuse' * Update rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml * Update rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml Co-authored-by: Mika Ayenson, PhD <[email protected]> * Update rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml --------- Co-authored-by: Mika Ayenson, PhD <[email protected]> Co-authored-by: Ruben Groenewoud <[email protected]> (cherry picked from commit ca640a6)
1 parent 1a5a960 commit 4a8b59d

File tree

1 file changed

+134
-0
lines changed

1 file changed

+134
-0
lines changed

‎rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
[metadata]
2+
creation_date = "2025/09/18"
3+
integration = ["azure"]
4+
maturity = "production"
5+
updated_date = "2025/09/18"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies potential abuse of actor tokens in Microsoft Entra ID audit logs. Actor tokens are undocumented backend
11+
mechanisms used by Microsoft for service-to-service (S2S) operations, allowing services to perform actions on behalf
12+
of users. These tokens appear in logs with the service's display name but the impersonated user's UPN. While some
13+
legitimate Microsoft operations use actor tokens, unexpected usage may indicate exploitation of CVE-2025-55241, which
14+
allowed unauthorized access to Azure AD Graph API across tenants before being patched by Microsoft.
15+
"""
16+
false_positives = [
17+
"""
18+
Creating specific groups via the Exchange Online PowerShell module will make Exchange use an Actor token on your
19+
behalf. The rule excludes group operations and directory feature operations to reduce false positives from these
20+
legitimate administrative activities.
21+
""",
22+
]
23+
from = "now-9m"
24+
interval = "8m"
25+
language = "esql"
26+
license = "Elastic License v2"
27+
name = "Entra ID Actor Token User Impersonation Abuse"
28+
note = """## Triage and analysis
29+
30+
### Investigating Entra ID Actor Token User Impersonation Abuse
31+
32+
This rule detects when Microsoft services use actor tokens to perform operations in audit logs. Actor tokens are undocumented backend mechanisms used by Microsoft for service-to-service (S2S) communication. They appear with a mismatch: the service's display name but the impersonated user's UPN. While some operations legitimately use actor tokens, unexpected usage may indicate exploitation of CVE-2025-55241, which allowed attackers to obtain Global Admin privileges across any Entra ID tenant. Note that this vulnerability has been patched by Microsoft as of September 2025.
33+
34+
### Possible investigation steps
35+
36+
- Review the `azure.auditlogs.properties.initiated_by.user.userPrincipalName` field to identify which service principals are exhibiting this behavior.
37+
- Check the `azure.auditlogs.properties.initiated_by.user.displayName` to confirm these are legitimate Microsoft services.
38+
- Analyze the actions performed by these service principals - look for privilege escalations, permission grants, or unusual administrative operations.
39+
- Review the timing and frequency of these events to identify potential attack patterns or automated exploitation.
40+
- Cross-reference with recent administrative changes or service configurations that might explain legitimate use cases.
41+
- Check if any new applications or service principals were registered recently that could be related to this activity.
42+
- Investigate any correlation with other suspicious authentication events or privilege escalation attempts in your tenant.
43+
44+
### False positive analysis
45+
46+
- Legitimate Microsoft service migrations or updates may temporarily exhibit this behavior.
47+
- Third-party integrations using Microsoft Graph or other APIs might trigger this pattern during normal operations.
48+
- Automated administrative tools or scripts using service principal authentication could be misconfigured.
49+
50+
### Response and remediation
51+
52+
- Immediately review and audit all service principal permissions and recent consent grants in your Entra ID tenant.
53+
- Disable or restrict any suspicious service principals exhibiting this behavior until verified.
54+
- Review and revoke any unnecessary application permissions, especially those with high privileges.
55+
- Enable and review Entra ID audit logs for any permission grants or role assignments made by these service principals.
56+
- Implement Conditional Access policies to restrict service principal authentication from unexpected locations or conditions.
57+
- Enable Entra ID Identity Protection to detect and respond to risky service principal behaviors.
58+
- Review and harden application consent policies to prevent unauthorized service principal registrations.
59+
- Consider implementing privileged identity management (PIM) for service principal role assignments.
60+
"""
61+
references = [
62+
"https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/",
63+
"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-55241"
64+
]
65+
risk_score = 47
66+
rule_id = "8e7a4f2c-9b3d-4e5a-a1b6-c2d8f7e9b3a5"
67+
severity = "medium"
68+
tags = [
69+
"Domain: Cloud",
70+
"Domain: Identity",
71+
"Data Source: Azure",
72+
"Data Source: Entra ID",
73+
"Data Source: Entra Audit Logs",
74+
"Use Case: Identity and Access Audit",
75+
"Use Case: Threat Detection",
76+
"Tactic: Initial Access",
77+
"Tactic: Privilege Escalation",
78+
"Resources: Investigation Guide",
79+
]
80+
timestamp_override = "event.ingested"
81+
type = "esql"
82+
83+
query = '''
84+
from logs-azure.auditlogs-* metadata _id, _version, _index
85+
| where azure.auditlogs.properties.initiated_by.user.displayName in (
86+
"Office 365 Exchange Online",
87+
"Skype for Business Online",
88+
"Dataverse",
89+
"Office 365 SharePoint Online",
90+
"Microsoft Dynamics ERP"
91+
) and
92+
not azure.auditlogs.operation_name like "*group*" and
93+
azure.auditlogs.operation_name != "Set directory feature on tenant"
94+
and azure.auditlogs.properties.initiated_by.user.userPrincipalName rlike ".+@[A-Za-z0-9.]+\\.[A-Za-z]{2,}"
95+
| keep
96+
_id,
97+
@timestamp,
98+
azure.*,
99+
client.*,
100+
event.*,
101+
source.*
102+
'''
103+
104+
105+
[[rule.threat]]
106+
framework = "MITRE ATT&CK"
107+
[[rule.threat.technique]]
108+
id = "T1078"
109+
name = "Valid Accounts"
110+
reference = "https://attack.mitre.org/techniques/T1078/"
111+
[[rule.threat.technique.subtechnique]]
112+
id = "T1078.004"
113+
name = "Cloud Accounts"
114+
reference = "https://attack.mitre.org/techniques/T1078/004/"
115+
116+
117+
118+
[rule.threat.tactic]
119+
id = "TA0001"
120+
name = "Initial Access"
121+
reference = "https://attack.mitre.org/tactics/TA0001/"
122+
[[rule.threat]]
123+
framework = "MITRE ATT&CK"
124+
[[rule.threat.technique]]
125+
id = "T1548"
126+
name = "Abuse Elevation Control Mechanism"
127+
reference = "https://attack.mitre.org/techniques/T1548/"
128+
129+
130+
[rule.threat.tactic]
131+
id = "TA0004"
132+
name = "Privilege Escalation"
133+
reference = "https://attack.mitre.org/tactics/TA0004/"
134+

0 commit comments

Comments
 (0)