Skip to content

Commit e67fb0a

Browse files
patel-bhavinpatel-bhavin
authored
Branch was auto-updated.
2 parents 4f2d064 + fb66f8c commit e67fb0a

10 files changed

+668
-0
lines changed

‎data_sources/azure_monitor_activity.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: Azure Monitor Activity
2+
id: 1997a515-a61a-4f78-ada9-54af34c764f2
3+
version: 1
4+
date: '2025-01-13'
5+
author: Bhavin Patel, Splunk
6+
description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
7+
source: Azure AD
8+
sourcetype: azure:monitor:activity
9+
separator: operationName
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Cloud Services
12+
url: https://splunkbase.splunk.com/app/3110
13+
version: 5.4.1
14+
fields:
15+
- column
16+
- action
17+
- category
18+
- change_type
19+
- command
20+
- correlationId
21+
- dataset_name
22+
- date_hour
23+
- date_mday
24+
- date_minute
25+
- date_month
26+
- date_second
27+
- date_wday
28+
- date_year
29+
- date_zone
30+
- dest
31+
- dvc
32+
- eventtype
33+
- host
34+
- identity
35+
- image_id
36+
- index
37+
- instance_type
38+
- linecount
39+
- object
40+
- object_attrs
41+
- object_category
42+
- object_id
43+
- object_path
44+
- operationName
45+
- properties.ActivityDate
46+
- properties.ActivityResultStatus
47+
- properties.ActivityType
48+
- properties.Actor.ActorType
49+
- properties.Actor.Application
50+
- properties.Actor.ApplicationName
51+
- properties.Actor.IsDelegatedAdmin
52+
- properties.Actor.Name
53+
- properties.Actor.ObjectId
54+
- properties.Actor.PartnerTenantId
55+
- properties.Actor.UPN
56+
- properties.Actor.UserPermissions{}
57+
- properties.AdditionalDetails
58+
- properties.AuditEventId
59+
- properties.Category
60+
- properties.RelationId
61+
- properties.TargetDisplayNames{}
62+
- properties.TargetObjectIds{}
63+
- properties.Targets{}.ModifiedProperties{}.Name
64+
- properties.Targets{}.ModifiedProperties{}.New
65+
- properties.Targets{}.ModifiedProperties{}.Old
66+
- properties.Targets{}.Name
67+
- punct
68+
- resourceId
69+
- resource_provider
70+
- response_body
71+
- result
72+
- resultDescription
73+
- resultType
74+
- result_id
75+
- source
76+
- sourcetype
77+
- splunk_server
78+
- splunk_server_group
79+
- src
80+
- status
81+
- tag
82+
- tag::action
83+
- tag::eventtype
84+
- tag::object_category
85+
- tenantId
86+
- time
87+
- timeendpos
88+
- timestartpos
89+
- user
90+
- user_name
91+
- user_type
92+
- vendor_account
93+
- vendor_product
94+
- vendor_region
95+
- _time
96+
example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "[email protected]"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": ["<null>"], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "[email protected]"}'

‎detections/cloud/azure_ad_azurehound_useragent_detected.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Azure AD AzureHound UserAgent Detected
2+
id: d62852db-a1f1-40db-a7fc-c3d56fa8bda3
3+
version: 1
4+
date: '2025-01-06'
5+
author: Dean Luxton
6+
data_sources:
7+
- Azure Active Directory NonInteractiveUserSignInLogs
8+
- Azure Active Directory MicrosoftGraphActivityLogs
9+
type: TTP
10+
status: production
11+
description: This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. AzureHound is a tool used for gathering information about Azure Active Directory environments, often employed by security professionals for legitimate auditing purposes. However, it can also be leveraged by malicious actors to perform reconnaissance activities, mapping out the Azure AD infrastructure to identify potential vulnerabilities and targets for further exploitation. Detecting its usage can help in identifying unauthorized access attempts and preemptively mitigating potential security threats to your Azure environment.
12+
search: >-
13+
`azure_monitor_aad` category IN (MicrosoftGraphActivityLogs, NonInteractiveUserSignInLogs) properties.userAgent=azurehound*
14+
| stats count min(_time) as firstTime max(_time) as lastTime values(properties.userAgent) as user_agent values(properties.userId) as user values(src_category) as src_category by src tenantId
15+
| `security_content_ctime(firstTime)`
16+
| `security_content_ctime(lastTime)`
17+
| iplocation src
18+
| `azure_ad_azurehound_useragent_detected_filter`
19+
how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest NonInteractiveUserSignInLogs and MicrosoftGraphActivityLogs via an Azure EventHub. See reference for links for further details.
20+
known_false_positives: None
21+
references:
22+
- https://github.com/SpecterOps/AzureHound
23+
- https://splunkbase.splunk.com/app/3110
24+
- https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Install
25+
drilldown_searches:
26+
- name: View the detection results for - "$user$"
27+
search: '%original_detection_search% | search user = "$user$"'
28+
earliest_offset: $info_min_time$
29+
latest_offset: $info_max_time$
30+
- name: View risk events for the last 7 days for - "$user$"
31+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
tags:
35+
analytic_story:
36+
- Azure Active Directory Privilege Escalation
37+
- Compromised User Account
38+
asset_type: Azure Tenant
39+
confidence: 100
40+
impact: 80
41+
message: AzureHound UserAgent String $user_agent$ Detected on Tenant $tenantId$
42+
mitre_attack_id:
43+
- T1087.004
44+
- T1526
45+
observable:
46+
- name: tenantId
47+
type: User
48+
role:
49+
- Victim
50+
- name: src
51+
type: IP Address
52+
role:
53+
- Attacker
54+
- name: user_agent
55+
type: Other
56+
role:
57+
- Attacker
58+
product:
59+
- Splunk Enterprise
60+
- Splunk Enterprise Security
61+
- Splunk Cloud
62+
required_fields:
63+
- src
64+
- category
65+
- properties.userAgent
66+
- tenantId
67+
risk_score: 80
68+
security_domain: identity
69+
tests:
70+
- name: True Positive Test
71+
attack_data:
72+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/azurehound/azurehound.log
73+
sourcetype: azure:monitor:aad
74+
source: Azure AD

‎detections/cloud/azure_ad_service_principal_enumeration.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Azure AD Service Principal Enumeration
2+
id: 3f0647ce-add5-4436-8039-cbd1abe74563
3+
version: 1
4+
date: '2025-01-06'
5+
author: Dean Luxton
6+
data_source:
7+
- Azure Active Directory MicrosoftGraphActivityLogs
8+
type: TTP
9+
status: production
10+
description: >-
11+
This detection leverages azure graph activity logs to identify when graph APIs have been used to identify 10 or more service principals.
12+
This type of behaviour is associated with tools such as Azure enumberation tools such as AzureHound or ROADtools.
13+
search: >-
14+
`azure_monitor_aad` category IN (MicrosoftGraphActivityLogs) TERM(servicePrincipals)
15+
| rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/beta\/servicePrincipals\/(?P<servicePrincipalb>.*?)\/"
16+
| rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/v1.0\/servicePrincipals\/(?P<servicePrincipalv1>.*?)\/"
17+
| eval spn=coalesce(servicePrincipalb,servicePrincipalv1) | stats min(_time) as _time dc(spn) as spn_count values(user) as user values(user_category) as user_category values(src_category) as src_category count by src tenantId properties.userAgent
18+
| rename properties.userAgent as user_agent
19+
| where spn_count>9 | `azure_ad_service_principal_enumeration_filter`
20+
how_to_implement: >-
21+
Run this detection over historical data to identify then tune out any known services which may be performing this action. Thresholds can be lowered or raised to meet requirements.
22+
The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest MicrosoftGraphActivityLogs via Azure EventHub. See reference for links for further details on how to onboard this log source.
23+
known_false_positives: Unknown
24+
references:
25+
- https://github.com/SpecterOps/AzureHound
26+
- https://github.com/dirkjanm/ROADtools
27+
- https://splunkbase.splunk.com/app/3110
28+
- https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Install
29+
drilldown_searches:
30+
- name: View the detection results for - "$user$"
31+
search: '%original_detection_search% | search user = "$user$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$user$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
tags:
39+
analytic_story:
40+
- Azure Active Directory Privilege Escalation
41+
- Compromised User Account
42+
asset_type: Azure Tenant
43+
confidence: 100
44+
impact: 80
45+
message: $spn_count$ Service Principals have been enumerated by $user$ from IP $src$
46+
mitre_attack_id:
47+
- T1087.004
48+
- T1526
49+
observable:
50+
- name: src
51+
type: IP Address
52+
role:
53+
- Attacker
54+
- name: tenantId
55+
type: User
56+
role:
57+
- Victim
58+
- name: user_agent
59+
type: Other
60+
role:
61+
- Attacker
62+
product:
63+
- Splunk Enterprise
64+
- Splunk Enterprise Security
65+
- Splunk Cloud
66+
required_fields:
67+
- category
68+
- properties.requestUri
69+
- src
70+
- user
71+
risk_score: 80
72+
security_domain: identity
73+
tests:
74+
- name: True Positive Test
75+
attack_data:
76+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/azurehound/azurehound.log
77+
sourcetype: azure:monitor:aad
78+
source: Azure AD

‎detections/cloud/azure_ad_service_principal_privilege_escalation.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: Azure AD Service Principal Privilege Escalation
2+
id: 29eb39d3-2bc8-49cc-99b3-35593191a588
3+
version: 1
4+
date: '2025-01-06'
5+
author: Dean Luxton
6+
data_sources:
7+
- Azure Active Directory Add app role assignment to service principal
8+
type: TTP
9+
status: production
10+
description: This detection identifies when an Azure Service Principal elevates privileges by adding themself to a new app role assignment.
11+
search: >-
12+
`azure_monitor_aad` category=AuditLogs operationName="Add app role assignment to service principal" properties.initiatedBy.app.displayName=* properties.result=Success
13+
| spath path=properties{}.targetResources{}.modifiedProperties{} output=targetResources
14+
| stats min(_time) as _time values(eval(mvfilter(match(targetResources, "AppRole.Value")))) as appRole, values(eval(mvfilter(match(targetResources, "ServicePrincipal.DisplayName")))) as targetServicePrincipal values(eval(mvindex('properties.targetResources{}.displayName',0))) as targetAppContext values(user_agent) as user_agent values(identity) as servicePrincipal values(properties.initiatedBy.app.servicePrincipalId) as servicePrincipalId by operationName tenantId correlationId
15+
| spath input=appRole path=newValue output=appRole
16+
| spath input=targetServicePrincipal path=newValue output=targetServicePrincipal
17+
| eval appRole=trim(replace(appRole, "\"", "")), targetServicePrincipal=trim(replace(targetServicePrincipal, "\"", ""))
18+
| where servicePrincipal=targetServicePrincipal
19+
| table _time operationName servicePrincipal servicePrincipalId appRole targetAppContext user_agent tenantId correlationId
20+
| `azure_ad_service_principal_privilege_escalation_filter`
21+
how_to_implement: The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest EntraID audit logs via Azure EventHub. See reference for links for further details on how to onboard this log source.
22+
known_false_positives: Unknown
23+
references:
24+
- https://splunkbase.splunk.com/app/3110
25+
- https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Install
26+
- https://github.com/mvelazc0/BadZure
27+
- https://www.splunk.com/en_us/blog/security/hunting-m365-invaders-navigating-the-shadows-of-midnight-blizzard.html
28+
- https://posts.specterops.io/microsoft-breach-what-happened-what-should-azure-admins-do-da2b7e674ebc
29+
drilldown_searches:
30+
- name: View the detection results for - "$servicePrincipal$"
31+
search: '%original_detection_search% | search servicePrincipal = "$servicePrincipal$"'
32+
earliest_offset: $info_min_time$
33+
latest_offset: $info_max_time$
34+
- name: View risk events for the last 7 days for - "$servicePrincipal$"
35+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$servicePrincipal$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
36+
earliest_offset: $info_min_time$
37+
latest_offset: $info_max_time$
38+
tags:
39+
analytic_story:
40+
- Azure Active Directory Privilege Escalation
41+
asset_type: Azure Tenant
42+
confidence: 100
43+
impact: 100
44+
message: Service Principal $servicePrincipal$ has elevated privileges by adding themself to app role $appRole$
45+
mitre_attack_id:
46+
- T1098.003
47+
- T1098
48+
observable:
49+
- name: servicePrincipal
50+
type: User
51+
role:
52+
- Victim
53+
- name: user_agent
54+
type: Other
55+
role:
56+
- Attacker
57+
product:
58+
- Splunk Enterprise
59+
- Splunk Enterprise Security
60+
- Splunk Cloud
61+
required_fields:
62+
- user_agent
63+
- identity
64+
- properties.initiatedBy.app.servicePrincipalId
65+
- operationName
66+
- tenantId
67+
- correlationId
68+
- category
69+
- properties.initiatedBy.app.displayName
70+
- properties.result
71+
- properties{}.targetResources{}.modifiedProperties{}
72+
- properties.targetResources{}.displayName
73+
risk_score: 100
74+
security_domain: identity
75+
tests:
76+
- name: True Positive Test
77+
attack_data:
78+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/azure_ad_spn_privesc.log
79+
sourcetype: azure:monitor:aad
80+
source: Azure AD

‎detections/cloud/microsoft_intune_device_health_scripts.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Microsoft Intune Device Health Scripts
2+
id: 6fe42e07-15b1-4caa-b547-7885666cb1bd
3+
version: 1
4+
date: '2025-01-06'
5+
author: Dean Luxton
6+
data_sources:
7+
- Azure Monitor Activity
8+
type: Hunting
9+
status: production
10+
description: >-
11+
Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices.
12+
This detection identifies when a new device health script has been added, updated or deleted.
13+
search: >-
14+
`azure_monitor_activity` operationName="*DeviceHealthScript*"
15+
| rename identity as user, properties.TargetObjectIds{} as TargetObjectId, properties.TargetDisplayNames{} as TargetDisplayName, properties.Actor.IsDelegatedAdmin as user_isDelegatedAdmin
16+
| rex field="operationName" "^(?P<action>\w+?)DeviceHealthScript" | replace "patch" with "updated", "create" with "created", "delete", with "deleted", "assign", with "assigned" IN action
17+
| table _time operationName action user user_type user_isDelegatedAdmin TargetDisplayName TargetObjectId status tenantId correlationId
18+
| `microsoft_intune_device_health_scripts_filter`
19+
how_to_implement: >-
20+
The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.
21+
To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
22+
Deploy as a risk based alerting rule for quick deployment or perform baselining & tune accordingly.
23+
known_false_positives: Legitimate adminstrative usage of this functionality will trigger this detection.
24+
references:
25+
- https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
26+
- https://securityintelligence.com/x-force/detecting-intune-lateral-movement/
27+
- https://posts.specterops.io/maestro-9ed71d38d546
28+
tags:
29+
analytic_story:
30+
- Azure Active Directory Account Takeover
31+
asset_type: Azure Tenant
32+
confidence: 40
33+
impact: 100
34+
message: Intune device health script $TargetObjectId$ was $action$ by user $user$
35+
mitre_attack_id:
36+
- T1072
37+
- T1021.007
38+
- T1202
39+
- T1105
40+
observable:
41+
- name: user
42+
type: User
43+
role:
44+
- Victim
45+
- name: TargetObjectId
46+
type: Other
47+
role:
48+
- Attacker
49+
product:
50+
- Splunk Enterprise
51+
- Splunk Enterprise Security
52+
- Splunk Cloud
53+
required_fields:
54+
- operationName
55+
- identity
56+
- properties.TargetObjectIds{}
57+
risk_score: 40
58+
security_domain: audit
59+
tests:
60+
- name: True Positive Test
61+
attack_data:
62+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1072/intune/intune.log
63+
sourcetype: azure:monitor:activity
64+
source: Azure AD

0 commit comments

Comments
 (0)