From 48128c1c66b72899cc62b0b68f93907aff2bc44d Mon Sep 17 00:00:00 2001 From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com> Date: Mon, 6 Apr 2026 09:40:21 -0400 Subject: [PATCH] [Rule Tuning] Entra ID Illicit Consent Grant via Registered Application - Fix New Terms Field (#5894) * [Rule Tuning] Entra ID Illicit Consent Grant via Registered Application - Fix New Terms Field Fixes #5893 * adding non-admin consented filter * converting to ESQL * additional query adjustments * adjusted query KEEP * updating non-ecs * Apply suggestion from @terrancedejesus --- detection_rules/etc/non-ecs-schema.json | 4 + ...sent_grant_via_registered_application.toml | 77 ++++++++++--------- 2 files changed, 43 insertions(+), 38 deletions(-) diff --git a/detection_rules/etc/non-ecs-schema.json b/detection_rules/etc/non-ecs-schema.json index 5722fd023..ba928fa7e 100644 --- a/detection_rules/etc/non-ecs-schema.json +++ b/detection_rules/etc/non-ecs-schema.json @@ -233,10 +233,14 @@ "azure.graphactivitylogs.properties.c_sid": "keyword" }, "logs-azure.auditlogs-*": { + "azure.auditlogs.properties.target_resources.0.display_name": "keyword", + "azure.auditlogs.properties.target_resources.0.id": "keyword", "azure.auditlogs.properties.target_resources.0.modified_properties.1.display_name": "keyword", "azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value": "keyword", "azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value": "keyword", "azure.auditlogs.properties.target_resources.0.modified_properties.2.new_value": "keyword", + "azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value": "keyword", + "azure.auditlogs.properties.target_resources.0.modified_properties.5.new_value": "keyword", "azure.auditlogs.properties.additional_details.value": "keyword", "azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value": "keyword", "azure.auditlogs.properties.target_resources.0.modified_properties.0.old_value": "keyword", diff --git a/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml b/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml index 8e0d6694b..7d1ff22f3 100644 --- a/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml +++ b/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml @@ -2,7 +2,7 @@ creation_date = "2020/09/01" integration = ["azure"] maturity = "production" -updated_date = "2026/03/24" +updated_date = "2026/03/30" [rule] author = ["Elastic"] @@ -12,9 +12,9 @@ register an application in Microsoft Entra ID for the purpose of requesting user accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user. """ -from = "now-9m" -index = ["logs-azure.auditlogs-*"] -language = "kuery" +from = "now-7d" +interval = "8m" +language = "esql" license = "Elastic License v2" name = "Entra ID Illicit Consent Grant via Registered Application" note = """## Triage and analysis @@ -23,9 +23,9 @@ note = """## Triage and analysis Adversaries may register a malicious application in Microsoft Entra ID and trick users into granting excessive permissions via OAuth consent. These applications can access sensitive data—such as mail, profiles, or files—on behalf of the user once consent is granted. This is commonly delivered via spearphishing links that prompt users to approve permissions for seemingly legitimate applications. -This rule identifies a new consent grant event based on Azure audit logs where the application was granted access with potentially risky scopes, such as offline_access, Mail.Read, or User.Read, and may include admin consent or tenant-wide delegation. +This rule identifies a new consent grant event based on Azure audit logs where a user or admin granted consent to an application. -This is a New Terms rule that will only trigger if the user and client ID have not been seen doing this activity in the last 14 days. +This rule uses ES|QL aggregation-based new terms logic with a 7-day history window. It extracts the AppId from the multi-valued additional_details array using MV_EXPAND and UUID regex filtering, then alerts when the user-application pair is first seen within the last 9 minutes OR when Microsoft flags the consent as a "Risky application detected". #### Possible investigation steps @@ -67,6 +67,7 @@ rule_id = "1c6a8c7a-5cb6-4a82-ba27-d5a5b8a40a38" severity = "medium" tags = [ "Domain: Cloud", + "Domain: Identity", "Data Source: Azure", "Data Source: Microsoft Entra ID", "Data Source: Microsoft Entra ID Audit Logs", @@ -75,17 +76,40 @@ tags = [ "Tactic: Initial Access", "Tactic: Credential Access", ] -timestamp_override = "event.ingested" -type = "new_terms" +type = "esql" query = ''' -event.dataset: "azure.auditlogs" and - ( - azure.auditlogs.operation_name:"Consent to application" - or event.action:"Consent to application" - ) - and event.outcome: "success" - and azure.auditlogs.properties.additional_details.key: "AppId" +FROM logs-azure.auditlogs-* metadata _id, _version, _index +| WHERE (azure.auditlogs.operation_name == "Consent to application" + OR event.action == "Consent to application") + AND event.outcome == "success" + +| MV_EXPAND azure.auditlogs.properties.additional_details.value +| WHERE azure.auditlogs.properties.additional_details.value + RLIKE "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}" +| RENAME azure.auditlogs.properties.additional_details.value AS Esql.app_id + +| STATS + Esql.timestamp_first_seen = MIN(@timestamp), + Esql.timestamp_last_seen = MAX(@timestamp), + Esql.app_display_name_values = VALUES(`azure.auditlogs.properties.target_resources.0.display_name`), + Esql.service_principal_id_values = VALUES(`azure.auditlogs.properties.target_resources.0.id`), + Esql.is_admin_consent_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value`), + Esql.is_app_only_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value`), + Esql.on_behalf_of_all_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.2.new_value`), + Esql.consent_context_tags_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value`), + Esql.consent_permissions_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value`), + Esql.consent_reason_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.5.new_value`), + Esql.user_id_values = VALUES(azure.auditlogs.properties.initiated_by.user.id), + Esql.ip_address_values = VALUES(azure.auditlogs.properties.initiated_by.user.ipAddress), + Esql.tenant_id_values = VALUES(azure.tenant_id), + Esql.correlation_id_values = VALUES(azure.auditlogs.properties.correlation_id), + Esql.event_count = COUNT(*) + BY azure.auditlogs.properties.initiated_by.user.userPrincipalName, Esql.app_id + +| WHERE Esql.timestamp_first_seen >= NOW() - 9 minutes + OR Esql.consent_reason_values LIKE "*Risky application detected*" +| KEEP Esql.*, azure.* ''' @@ -124,27 +148,4 @@ id = "TA0006" name = "Credential Access" reference = "https://attack.mitre.org/tactics/TA0006/" -[rule.investigation_fields] -field_names = [ - "@timestamp", - "event.action", - "event.outcome", - "azure.auditlogs.properties.initiated_by.user.userPrincipalName", - "azure.auditlogs.properties.initiated_by.user.ipAddress", - "azure.auditlogs.properties.additional_details.value", - "azure.tenant_id", - "cloud.region", - "azure.auditlogs.properties.target_resources.0.display_name" -] - -[rule.new_terms] -field = "new_terms_fields" -value = [ - "azure.auditlogs.properties.initiated_by.user.userPrincipalName", - "azure.auditlogs.properties.additional_details.value", -] -[[rule.new_terms.history_window_start]] -field = "history_window_start" -value = "now-14d" -