security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Possible Consent Grant Attack via Azure-Registered Application (#575)

Browse Source 
* Update initial_access_consent_grant_attack_via_azure_registered_application.toml

* bump updated_date

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
This commit is contained in:
David French
2020-12-08 17:20:30 -07:00
committed by GitHub
parent 24828ea9cb
commit b8d2f6fc96
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml
+5 -4
View File
@@ -1,12 +1,12 @@
[metadata]
creation_date = "2020/09/01"
maturity = "production"
updated_date = "2020/10/26"
updated_date = "2020/12/08"
[rule]
author = ["Elastic"]
description = """
Identifies when a user grants permissions to an Azure-registered application or when an administrator grants tenant-wide
Detects when a user grants permissions to an Azure-registered application or when an administrator grants tenant-wide
permissions to an application. An adversary may create an Azure-registered application that requests access to data such
as contact information, email, or documents.
"""
@@ -30,10 +30,11 @@ tags = ["Elastic", "Cloud", "Azure", "Continuous Monitoring", "SecOps", "Identit
type = "query"
query = '''
event.dataset:(azure.activitylogs or azure.auditlogs) and
event.dataset:(azure.activitylogs or azure.auditlogs or o365.audit) and
(
azure.activitylogs.operation_name:"Consent to application" or
azure.auditlogs.operation_name:"Consent to application"
azure.auditlogs.operation_name:"Consent to application" or
o365.audit.Operation:"Consent to application."
) and
event.outcome:success
'''