New Azure AD Detections

.github/workflows/contentctl_test.yml

@@ -0,0 +1,31 @@
+name: Initial contentctl test workflow
+
+# Trigger the workflow on pull request
+on:
+    push:
+    pull_request:
+      types: [opened, reopened]
+
+jobs:
+  contentctl_test:
+    name: run contentctl test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
+          architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
+
+      - name: Check out the repository code
+        uses: actions/checkout@v3
+
+      - name: Everything
+        run: |
+            git clone https://github.com/splunk/contentctl
+            cd contentctl 
+            git checkout diff_test_cli_support
+            git pull
+            python -m pip install poetry
+            poetry install
+            poetry run contentctl -p ../ validate
+            poetry run contentctl -p ../ test --mode changes --target_branch develop --test_branch TR_3232_azure_ad

contentctl.yml

@@ -20,6 +20,6 @@ build_ssa:
 build_api:
   path_root: 'dist/api'
 enrichments:
-  attack_enrichment: true
-  cve_enrichment: true
-  splunk_app_enrichment: false
+  attack_enrichment: false
+  cve_enrichment: false
+  splunk_app_enrichment: false

contentctl_test.yml

@@ -1,4 +1,7 @@
-version_control_config: {}
+version_control_config:
+  repo_path: ../
+  repo_url: https://github.com/splunk/security_content
+
 infrastructure_config:
   infrastructure_type: container
   full_image_path: registry.hub.docker.com/splunk/splunk:latest
@@ -18,6 +21,26 @@ apps:
   splunkbase_path: null
   environment_path: ENVIRONMENT_PATH_NOT_SET
   force_local: false
+- uid: 3110
+  appid: Splunk_TA_linux_sysmon
+  title: Add-on for Linux Sysmon
+  description: null
+  release: 1.0.4
+  local_path: null
+  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_510.tgz
+  splunkbase_path: null
+  environment_path: ENVIRONMENT_PATH_NOT_SET
+  force_local: false
+- uid: 4055
+  appid: Splunk_TA_linux_sysmon
+  title: Add-on for Linux Sysmon
+  description: null
+  release: 1.0.4
+  local_path: null
+  http_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_430.tgz
+  splunkbase_path: null
+  environment_path: ENVIRONMENT_PATH_NOT_SET
+  force_local: false
 - uid: 742
   appid: Splunk_TA_windows
   title: Splunk Add-on for Microsoft Windows

detections/cloud/azure_ad_block_user_consent_for_risky_apps_disabled.yml

@@ -0,0 +1,62 @@
+name: Azure AD Block User Consent For Risky Apps Disabled
+id: 875de3d7-09bc-4916-8c0a-0929f4ced3d8
+version: 1
+date: '2023-10-26'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: This analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. This setting, when enabled, prevents regular users from granting consent to potentially malicious OAuth applications, requiring an administrative step-up for consent instead. Disabling this feature could expose the organization to OAuth phishing threats.The detection operates by monitoring Azure Active Directory logs for events where the "Update authorization policy" operation is performed. It specifically looks for changes to the "AllowUserConsentForRiskyApps" setting, identifying instances where this setting is switched to "true," effectively disabling the risk-based step-up consent. Monitoring for changes to critical security settings like the "risk-based step-up consent" is vital for maintaining the integrity of an organization's security posture. Disabling this feature can make the environment more susceptible to OAuth phishing attacks, where attackers trick users into granting permissions to malicious applications. Identifying when this setting is disabled can help blue teams to quickly respond, investigate, and potentially uncover targeted phishing campaigns against their users. If an attacker successfully disables the "risk-based step-up consent" and subsequently launches an OAuth phishing campaign, they could gain unauthorized access to user data and other sensitive information within the M365 environment. This could lead to data breaches, unauthorized access to emails, and potentially further compromise within the organization
+search: >-
+ `azure_monitor_aad` operationName="Update authorization policy"
+ | rename properties.* as * 
+ | eval index_number = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "AllowUserConsentForRiskyApps") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "AllowUserConsentForRiskyApps"), -1)
+ | search index_number >= 0 
+ | eval AllowUserConsentForRiskyApps = mvindex('targetResources{}.modifiedProperties{}.newValue',index_number)
+ | search AllowUserConsentForRiskyApps = "[true]"
+ | stats count min(_time) as firstTime max(_time) as lastTime by user, src_ip, operationName, AllowUserConsentForRiskyApps
+ | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+ | `azure_ad_block_user_consent_for_risky_apps_disabled_filter`
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
+  This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.
+known_false_positives: Legitimate changes to the 'risk-based step-up consent' setting by administrators, perhaps as part of a policy update or security assessment, may trigger this alert, necessitating verification of the change's intent and authorization
+references:
+- https://attack.mitre.org/techniques/T1562/
+- https://goodworkaround.com/2020/10/19/a-look-behind-the-azure-ad-permission-classifications-preview/
+- https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-risk-based-step-up-consent
+- https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  confidence: 50
+  impact: 60
+  message: User $user$ disabled the BlockUserConsentForRiskyApps Azure AD setting.
+  mitre_attack_id:
+  - T1562
+  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 30
+  required_fields:
+  - _time
+  - operationName
+  - properties.targetResources{}.modifiedProperties{}.displayName
+  - properties.targetResources{}.modifiedProperties{}.newValue
+  - user
+  - src_ip
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/azuread_disable_blockconsent_for_riskapps.log
+    source: Azure Ad
+    sourcetype: azure:monitor:aad

detections/cloud/azure_ad_device_code_authentication.yml

@@ -0,0 +1,74 @@
+name: Azure AD Device Code Authentication
+id: d68d8732-6f7e-4ee5-a6eb-737f2b990b91
+version: 1
+date: '2023-08-03'
+author: Mauricio Velazco, Gowthamaraj Rajendran,  Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies the execution of the Azure Device Code Phishing attack, 
+  which can lead to Azure Account Take-Over (ATO). The detection leverages Azure AD logs specifically 
+  focusing on authentication requests to identify the attack. This technique involves creating malicious 
+  infrastructure, bypassing Multi-Factor Authentication (MFA), and bypassing Conditional Access Policies (CAPs). 
+  The attack aims to compromise users by sending them phishing emails from attacker-controlled domains and trick 
+  the victims into performing OAuth 2.0 device authentication. A successful execution of this attack can result 
+  in adversaries gaining unauthorized access to Azure AD, Exchange mailboxes, and the target's Outlook Web Application (OWA). 
+  This attack technique was detailed by security researchers including Bobby Cooke, Stephan Borosh, and others. 
+  It's crucial for organizations to be aware of this threat, as it can lead to unauthorized access and potential data breaches.
+search: '`azure_monitor_aad` category=SignInLogs "properties.authenticationProtocol"=deviceCode 
+  | rename properties.* as * 
+  | stats count min(_time) as firstTime max(_time) as lastTime by user src_ip, appDisplayName, userAgent
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `azure_ad_device_code_authentication_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
+  This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
+known_false_positives: In most organizations, device code authentication will be used to access common Microsoft service but it may be legitimate for others. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1528
+- https://github.com/rvrsh3ll/TokenTactics
+- https://embracethered.com/blog/posts/2022/device-code-phishing/
+- https://0xboku.com/2021/07/12/ArtOfDeviceCodePhish.html
+- https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  confidence: 50
+  impact: 70
+  message: Device code requested for $user$ from $src_ip$
+  mitre_attack_id:
+  - T1528
+  - T1566
+  - T1566.002
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 35
+  required_fields:
+  - _time
+  - category
+  - user
+  - properties.authenticationProtocol
+  - properties.ipAddress
+  - properties.status.additionalDetails
+  - properties.appDisplayName
+  - properties.userAgent
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1528/device_code_authentication/azure-audit.log
+    source: Azure AD
+    sourcetype: azure:monitor:aad

detections/cloud/azure_ad_multi_source_failed_authentications_spike.yml

@@ -0,0 +1,60 @@
+name: Azure AD Multi-Source Failed Authentications Spike
+id: 116e11a9-63ea-41eb-a66a-6a13bdc7d2c7
+version: 1
+date: '2023-11-08'
+author: Mauricio Velazco, Splunk
+status: production
+type: Hunting
+data_source: []
+description: This analytic detects potential distributed password spraying attacks within an Azure AD environment. It identifies a notable increase in failed authentication attempts across a variety of unique user-and-IP address combinations, originating from multiple source IP addresses and countries, and employing different user agents. Such patterns suggest an adversary's attempt to bypass security controls by using a range of IP addresses to test commonly used passwords against numerous user accounts. The detection scrutinizes SignInLogs from Azure AD logs, particularly focusing on events with error code 50126, which signals a failed authentication due to incorrect credentials. By collating data over a five-minute interval, the analytic computes the distinct counts of user-and-IP combinations, unique users, source IPs, and countries. It then applies a set of thresholds to these metrics to pinpoint unusual activities that could indicate a coordinated attack effort. The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Recognizing this behavior is vital for security operations centers (SOCs) as distributed password spraying represents a more complex form of traditional password spraying. Attackers distribute the source of their attempts to evade detection mechanisms that typically monitor for single-source IP anomalies. Prompt detection of such distributed activities is essential to thwart unauthorized access attempts, prevent account compromises, and mitigate the risk of further malicious activities within the organization's network. A true positive alert from this analytic suggests an active distributed password spraying attack against the organization's Azure AD tenant. A successful attack could result in unauthorized access, particularly to accounts with elevated privileges, leading to data breaches, privilege escalation, persistent threats, and lateral movement within the organization's infrastructure.
+search: ' `azure_monitor_aad` category=SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
+ | rename properties.* as * 
+ | bucket span=5m _time 
+ | eval uniqueIPUserCombo = src_ip . "-" . user
+ | stats dc(uniqueIPUserCombo) as uniqueIpUserCombinations, dc(user) as uniqueUsers, dc(src_ip) as uniqueIPs, dc(location.countryOrRegion) as uniqueCountries values(user) as users, values(src_ip) as ips, values(user_agent) as user_agents, values(location.countryOrRegion) as countries by _time
+ | where uniqueIpUserCombinations > 20 AND uniqueUsers > 20 AND uniqueIPs > 20
+ | `azure_ad_multi_source_failed_authentications_spike_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub.
+  This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
+  The thresholds set within the analytic (such as unique IPs, unique users, etc.) are initial guidelines and should be customized based on the organization's user behavior and risk profile. Security teams are encouraged to adjust these thresholds to optimize the balance between detecting genuine threats and minimizing false positives, ensuring the detection is tailored to their specific environment.
+known_false_positives: This detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of VPNs or cloud services that rotate IP addresses. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
+- https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
+- https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
+tags:
+  analytic_story:
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD 
+  atomic_guid: []
+  confidence: 60
+  impact: 70
+  message: An anomalous multi source authentication spike ocurred at $_time$
+  mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1110
+  - T1110.003
+  - T1110.004
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 42
+  required_fields:
+  - _time
+  - category
+  - properties.authenticationDetails{}.succeeded
+  - properties.location.countryOrRegion
+  - user_agent
+  - src_ip
+  - user
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/azure_ad_distributed_spray.log
+    source: Azure AD
+    sourcetype: azure:monitor:aad