Skip to content

Commit 0b0ab0d

Browse files
committed
updating azure
1 parent 0bf1bac commit 0b0ab0d

File tree

2 files changed

+123
-2
lines changed

2 files changed

+123
-2
lines changed

data_sources/azure_active_directory_noninteractiveusersigninlogs.yml

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,126 @@ supported_TA:
1212
url: https://splunkbase.splunk.com/app/3110
1313
version: 5.4.2
1414
fields:
15+
- action
16+
- additional_details
17+
- app
18+
- authentication_method
19+
- authentication_service
20+
- callerIpAddress
21+
- category
22+
- change_type
23+
- command
24+
- correlationId
25+
- dataset_name
26+
- date_hour
27+
- date_mday
28+
- date_minute
29+
- date_month
30+
- date_second
31+
- date_wday
32+
- date_year
33+
- date_zone
34+
- description
35+
- dest
36+
- dest_type
37+
- duration
38+
- durationMs
39+
- dvc
40+
- enabled
41+
- eventtype
42+
- host
43+
- id
44+
- index
45+
- level
46+
- linecount
47+
- location
48+
- object
49+
- object_attrs
50+
- object_category
51+
- object_id
52+
- object_path
53+
- operationName
54+
- operationVersion
55+
- path_from_resourceId
56+
- properties.C_Iat
57+
- properties.C_Idtyp
58+
- properties.UserPrincipalObjectID
59+
- properties.__UDI_RequiredFields_EventTime
60+
- properties.__UDI_RequiredFields_RegionScope
61+
- properties.__UDI_RequiredFields_TenantId
62+
- properties.__UDI_RequiredFields_UniqueId
63+
- properties.apiVersion
64+
- properties.appId
65+
- properties.clientAuthMethod
66+
- properties.clientRequestId
67+
- properties.durationMs
68+
- properties.identityProvider
69+
- properties.ipAddress
70+
- properties.location
71+
- properties.operationId
72+
- properties.requestId
73+
- properties.requestMethod
74+
- properties.requestUri
75+
- properties.responseSizeBytes
76+
- properties.responseStatusCode
77+
- properties.resultReason
78+
- properties.roles
79+
- properties.scopes
80+
- properties.signInActivityId
81+
- properties.tenantId
82+
- properties.timeGenerated
83+
- properties.tokenIssuedAt
84+
- properties.userAgent
85+
- properties.userId
86+
- properties.wids
87+
- punct
88+
- reason
89+
- resourceId
90+
- response_time
91+
- result
92+
- resultSignature
93+
- result_id
94+
- severity
95+
- signature
96+
- signature_id
97+
- signinDateTime
98+
- source
99+
- sourcetype
100+
- splunk_server
101+
- splunk_server_group
102+
- src
103+
- src_ip
104+
- src_user
105+
- src_user_name
106+
- src_user_type
107+
- status
108+
- tag
109+
- tag::action
110+
- tag::app
111+
- tag::eventtype
112+
- tag::object_category
113+
- tenantId
114+
- time
115+
- timeendpos
116+
- timestartpos
117+
- user
118+
- user_agent
119+
- user_id
120+
- user_name
121+
- user_role
122+
- user_type
123+
- vendor_account
124+
- vendor_product
125+
- vendor_region
126+
- _bkt
127+
- _cd
128+
- _eventtype_color
129+
- _indextime
130+
- _raw
131+
- _serial
132+
- _si
133+
- _sourcetype
134+
- _subsecond
15135
- _time
16136
example_log: |-
137+
{"time": "2023-01-12T19:22:14.5285742Z", "resourceId": "/tenants/95d19bda-09de-4d93-b7ae-acecd1e68186/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "NonInteractiveUserSignInLogs", "tenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "resultType": "0", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "34.1.3.194", "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "identity": "User30", "Level": 4, "location": "US", "properties": {"id": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "createdDateTime": "2023-01-12T19:22:14.5285742+00:00", "userDisplayName": "User30", "userPrincipalName": "[email protected]", "userId": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "34.1.3.194", "status": {"errorCode": 0, "additionalDetails": "MFA requirement satisfied by claim in the token"}, "clientAppUsed": "Browser", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows", "browser": "Rich Client 4.43.0.0"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 45.73722839355469, "longitude": -119.81143188476562}}, "mfaDetail": {}, "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [{"id": "SecurityDefaults", "displayName": "Security Defaults", "enforcedGrantControls": [], "enforcedSessionControls": [], "result": "success", "conditionsSatisfied": 3, "conditionsNotSatisfied": 0}], "authenticationContextClassReferences": [], "originalRequestId": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "isInteractive": false, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Oauth Scope Info", "value": "[\"OfficeHome.All\"]"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 192, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "resourceTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "homeTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "authenticationDetails": [{"authenticationStepDateTime": "2023-01-12T19:22:14.5285742+00:00", "authenticationMethod": "Previously satisfied", "succeeded": true, "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token", "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "authenticationRequirement": "multiFactorAuthentication", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-_WUD4M1Rkyb-gOQwZiIAA", "authenticationStrengths": [], "incomingTokenType": "primaryRefreshToken", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": null, "rngcStatus": 0}}

detections/cloud/azure_ad_azurehound_useragent_detected.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: Azure AD AzureHound UserAgent Detected
2-
id: d62852db-a1f1-40db-a7fc-c3d56fa8bda3
2+
id: d62852db-a1f1-40db-a7fc-c3d56fa8bda3
33
version: 2
44
date: '2025-01-06'
55
author: Dean Luxton
@@ -41,7 +41,7 @@ rba:
4141
- field: src
4242
type: ip_address
4343
- field: user_agent
44-
type: http_user_agent
44+
type: http_user_agent
4545
tags:
4646
analytic_story:
4747
- Azure Active Directory Privilege Escalation

0 commit comments

Comments
 (0)