[New Rule] Azure Blob Permissions Modification (#1499)

* Create defense_evasion_azure_blob_permissions_modified.toml * Update defense_evasion_azure_blob_permissions_modified.toml * Update defense_evasion_azure_blob_permissions_modified.toml * Update description and query (spacing) Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
2021-10-14 04:59:24 -05:00
parent 3d15c2072d
commit 7123d46623
1 changed files with 54 additions and 0 deletions
@@ -0,0 +1,54 @@
+[metadata]
+creation_date = "2021/09/22"
+maturity = "production"
+updated_date = "2021/09/22"
+integration = "azure"
+
+[rule]
+author = ["Austin Songer"]
+description = """
+Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure
+Blob. An adversary may modify the permissions on a blob to weaken their target's security controls
+or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss.
+"""
+false_positives = [
+    """
+    Blob permissions may be modified by system administrators. Verify that the configuration change was
+    expected. Exceptions can be added to this rule to filter expected behavior.
+    """,
+]
+index = ["filebeat-*", "logs-azure*"]
+language = "kuery"
+license = "Elastic License v2"
+name = "Azure Blob Permissions Modification"
+note = """## Config
+
+The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
+references = ["https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles"]
+risk_score = 47
+rule_id = "d79c4b2a-6134-4edd-86e6-564a92a933f9"
+severity = "medium"
+tags = ["Elastic", "Cloud", "Azure", "Continuous Monitoring", "SecOps", "Identity and Access"]
+timestamp_override = "event.ingested"
+type = "query"
+
+query = '''
+event.dataset:azure.activitylogs and azure.activitylogs.operation_name:(
+     "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MANAGEOWNERSHIP/ACTION" or
+     "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MODIFYPERMISSIONS/ACTION") and 
+  event.outcome:(Success or success)
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1222"
+name = "File and Directory Permissions Modification"
+reference = "https://attack.mitre.org/techniques/T1222/"
+
+
+[rule.threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"