Skip to content

Commit 817a2ed

Browse files
terrancedejesustradebot-elastic
terrancedejesus
authored and
tradebot-elastic
committed
[New Rule] TeamFiltration User-Agents Detected (#4868)
* new rule TeamFiltration User-Agents Detected * changed UUID * tightened index scope * fixing query optimization * adjusted query (cherry picked from commit 6e2936a)
1 parent 873028b commit 817a2ed

File tree

2 files changed

+175
-1
lines changed

2 files changed

+175
-1
lines changed

‎rules/integrations/azure/credential_access_entra_id_brute_force_activity.toml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ integration = ["azure"]
44
maturity = "production"
55
min_stack_comments = "Elastic ES|QL values aggregation is more performant in 8.16.5 and above."
66
min_stack_version = "8.17.0"
7-
updated_date = "2025/06/05"
7+
updated_date = "2025/07/02"
88

99
[rule]
1010
author = ["Elastic"]
@@ -62,6 +62,7 @@ This rule detects brute-force authentication activity in Entra ID sign-in logs.
6262
- Implement account lockout or throttling for failed sign-in attempts where possible.
6363
"""
6464
references = [
65+
"https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign",
6566
"https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/",
6667
"https://cloud.hacktricks.xyz/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-password-spraying",
6768
"https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-password-spray",

‎rules/integrations/azure/discovery_teamfiltration_user_agents_detected.toml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
[metadata]
2+
creation_date = "2025/07/02"
3+
integration = ["azure", "o365"]
4+
maturity = "production"
5+
updated_date = "2025/07/02"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies potential enumeration or password spraying activity using TeamFiltration tool. TeamFiltration is an
11+
open-source enumeration, password spraying and exfiltration tool designed for Entra ID and Microsoft 365. Adversaries
12+
are known to use TeamFiltration in-the-wild to enumerate users, groups, and roles, as well as to perform password
13+
spraying attacks against Microsoft Entra ID and Microsoft 365 accounts. This rule detects the use of TeamFiltration by
14+
monitoring for specific user-agent strings associated with the tool in Azure and Microsoft 365 logs.
15+
"""
16+
false_positives = [
17+
"""
18+
Legitimate administrative or security assessment activities may use these user-agents, especially in environments
19+
where TeamFiltration is employed for authorized audits. If this is expected behavior, consider adjusting the rule or
20+
adding exceptions for specific user-agents or IP addresses.
21+
""",
22+
"""
23+
Expected red team assessments or penetration tests may utilize TeamFiltration to evaluate the security posture of
24+
Azure or Microsoft 365 environments. If this is expected behavior, consider adjusting the rule or adding exceptions
25+
for specific IP addresses, registered applications, JWT tokens, PRTs or user
26+
""",
27+
]
28+
from = "now-9m"
29+
index = ["filebeat-*", "logs-azure.signinlogs-*", "logs-o365.audit-*"]
30+
language = "kuery"
31+
license = "Elastic License v2"
32+
name = "TeamFiltration User-Agents Detected"
33+
note = """## Triage and analysis
34+
35+
Identifies potential enumeration or password spraying activity using TeamFiltration tool. TeamFiltration is an open-source enumeration, password spraying and exfiltration tool designed for Entra ID and Microsoft 365. Adversaries are known to use TeamFiltration in-the-wild to enumerate users, groups, and roles, as well as to perform password spraying attacks against Microsoft Entra ID and Microsoft 365 accounts. This rule detects the use of TeamFiltration by monitoring for specific user-agent strings associated with the tool in Azure and Microsoft 365 logs.
36+
37+
The detection is based on TeamFiltration's hardcoded user agent string and/or the use of `Electron` by monitoring multiple log sources, including:
38+
39+
- Azure Graph API Activity Logs
40+
- Microsoft 365 Audit Logs
41+
- Entra ID Sign-in Logs
42+
- Entra ID Audit Logs
43+
- Azure Activity Logs
44+
45+
### Possible investigation steps
46+
47+
- Confirm the tool used via `user_agent.original`.
48+
- Identify the `user.id`, `user.name`, or `azure.signinlogs.properties.user_principal_name` fields to determine which identity executed the API requests or sign-in attempts.
49+
- Review `app_id`, `app_display_name`, or `client_id` to identify the application context (e.g., Azure CLI, Graph Explorer, unauthorized app). TeamFiltration uses a list of FOCI compliant applications to perform enumeration and password spraying. TeamFiltration uses Microsoft Teams client ID `1fec8e78-bce4-4aaf-ab1b-5451cc387264` for enumeration.
50+
- Check `http.request.method`, `http.response.status_code`, and `event.action` for enumeration patterns (many successful GETs in a short period) if Graph API activity logs.
51+
- Investigate correlated sign-ins (`azure.signinlogs`) by the same user, IP, or app immediately preceding the API calls. Was MFA used? Is the location suspicious?
52+
- Review `source.ip` or `client.geo.*` fields to determine the origin of the requests. Flag unexpected IPs or ISPs. Check the for the use of several source addresses originating from Amazon ASNs (e.g., `AS16509`, `AS14618`, `AS14618`) which are commonly used by TeamFiltration as it proxies requests through FireProx and Amazon API Gateway.
53+
- If the event originates in M365 Audit Logs, investigate cross-service activity: Exchange Online, Teams, SharePoint, or role escalations via Unified Audit.
54+
55+
### False positive analysis
56+
57+
- This activity may be benign if performed by red teams, internal security auditors, or known security tools under authorization.
58+
59+
### Response and remediation
60+
61+
- If confirmed malicious:
62+
- Identify successful sign-in attempts or API calls made by the user or app.
63+
- Revoke active sessions or tokens associated with the identified user/app.
64+
- Disable the account or rotate credentials immediately.
65+
- Review the role assignments (`Directory.Read.All`, `AuditLog.Read.All`, `Directory.AccessAsUser.All`) and remove excessive privileges.
66+
- Conduct historical analysis to determine how long enumeration has been occurring and what objects were queried.
67+
- Enable Conditional Access policies to require MFA for API and CLI-based access.
68+
- Validate audit logging and alerting is enabled across Microsoft Graph, Azure Activity Logs, and M365 workloads.
69+
70+
- If legitimate:
71+
- Document the source or user (e.g., red team operation, security tool).
72+
- Add appropriate allowlist conditions for service principal, user, source address or device if policy allows.
73+
74+
"""
75+
references = [
76+
"https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign",
77+
"https://github.com/Flangvik/TeamFiltration",
78+
]
79+
risk_score = 47
80+
rule_id = "f541ca3a-5752-11f0-b44b-f661ea17fbcd"
81+
severity = "medium"
82+
tags = [
83+
"Domain: Cloud",
84+
"Data Source: Azure",
85+
"Data Source: Microsoft 365",
86+
"Data Source: Microsoft 365 Audit Logs",
87+
"Data Source: Microsoft Entra ID",
88+
"Data Source: Microsoft Entra ID Sign-in Logs",
89+
"Use Case: Identity and Access Audit",
90+
"Use Case: Threat Detection",
91+
"Tactic: Discovery",
92+
"Resources: Investigation Guide",
93+
]
94+
timestamp_override = "event.ingested"
95+
type = "query"
96+
97+
query = '''
98+
event.dataset:("azure.signinlogs" or "o365.audit")
99+
and ((user_agent.name:"Electron" and user_agent.os.name:"Windows" and user_agent.version:"8.5.1") or
100+
user_agent.original:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1 Safari/537.36")
101+
'''
102+
103+
104+
[[rule.threat]]
105+
framework = "MITRE ATT&CK"
106+
[[rule.threat.technique]]
107+
id = "T1069"
108+
name = "Permission Groups Discovery"
109+
reference = "https://attack.mitre.org/techniques/T1069/"
110+
[[rule.threat.technique.subtechnique]]
111+
id = "T1069.003"
112+
name = "Cloud Groups"
113+
reference = "https://attack.mitre.org/techniques/T1069/003/"
114+
115+
116+
[[rule.threat.technique]]
117+
id = "T1082"
118+
name = "System Information Discovery"
119+
reference = "https://attack.mitre.org/techniques/T1082/"
120+
121+
[[rule.threat.technique]]
122+
id = "T1087"
123+
name = "Account Discovery"
124+
reference = "https://attack.mitre.org/techniques/T1087/"
125+
[[rule.threat.technique.subtechnique]]
126+
id = "T1087.004"
127+
name = "Cloud Account"
128+
reference = "https://attack.mitre.org/techniques/T1087/004/"
129+
130+
131+
[[rule.threat.technique]]
132+
id = "T1201"
133+
name = "Password Policy Discovery"
134+
reference = "https://attack.mitre.org/techniques/T1201/"
135+
136+
[[rule.threat.technique]]
137+
id = "T1526"
138+
name = "Cloud Service Discovery"
139+
reference = "https://attack.mitre.org/techniques/T1526/"
140+
141+
[[rule.threat.technique]]
142+
id = "T1580"
143+
name = "Cloud Infrastructure Discovery"
144+
reference = "https://attack.mitre.org/techniques/T1580/"
145+
146+
[[rule.threat.technique]]
147+
id = "T1673"
148+
name = "Virtual Machine Discovery"
149+
reference = "https://attack.mitre.org/techniques/T1673/"
150+
151+
152+
[rule.threat.tactic]
153+
id = "TA0007"
154+
name = "Discovery"
155+
reference = "https://attack.mitre.org/tactics/TA0007/"
156+
[[rule.threat]]
157+
framework = "MITRE ATT&CK"
158+
[[rule.threat.technique]]
159+
id = "T1110"
160+
name = "Brute Force"
161+
reference = "https://attack.mitre.org/techniques/T1110/"
162+
[[rule.threat.technique.subtechnique]]
163+
id = "T1110.003"
164+
name = "Password Spraying"
165+
reference = "https://attack.mitre.org/techniques/T1110/003/"
166+
167+
168+
169+
[rule.threat.tactic]
170+
id = "TA0006"
171+
name = "Credential Access"
172+
reference = "https://attack.mitre.org/tactics/TA0006/"
173+

0 commit comments

Comments
 (0)