From a9b860d749d6a32f38ca85ee797bfbc79643b239 Mon Sep 17 00:00:00 2001 From: duzvik Date: Wed, 15 Jul 2020 14:24:49 +0300 Subject: [PATCH] Update sysmon_abusing_azure_browser_sso.yml --- rules/windows/sysmon/sysmon_abusing_azure_browser_sso.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/windows/sysmon/sysmon_abusing_azure_browser_sso.yml b/rules/windows/sysmon/sysmon_abusing_azure_browser_sso.yml index b8824ddfc..023a308a6 100644 --- a/rules/windows/sysmon/sysmon_abusing_azure_browser_sso.yml +++ b/rules/windows/sysmon/sysmon_abusing_azure_browser_sso.yml @@ -3,7 +3,7 @@ author: Den Iuzvyk description: Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user. reference: - https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30 -date: 2020/07/15 +date: 2020/07/15 id: 50f852e6-af22-4c78-9ede-42ef36aa3453 detection: condition: selection_dll and not filter_legit