From cedb2e1289b46220cf91bd27b90b7edab398327c Mon Sep 17 00:00:00 2001 From: David French <56409778+threat-punter@users.noreply.github.com> Date: Tue, 22 Sep 2020 09:28:32 -0600 Subject: [PATCH] [New Rule] Azure Conditional Access Policy Modified (#237) * new-rule-azure-conditional-access-policy-modified * Update rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml Update maturity to production Co-authored-by: Justin Ibarra * Update rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml * Update query to include result value * Update rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml * Update query to search both the Azure audit logs and activity logs * Optimize formatting of query * Tweak consent grant attack rule Amending the query in rule, "Possible Consent Grant Attack via Azure-Registered Application" to search both the Azure activity and audit logs * Tweak formatting of query to improve Brent's happiness level Co-authored-by: Justin Ibarra --- ...re_conditional_access_policy_modified.toml | 49 +++++++++++++++++++ ...tack_via_azure_registered_application.toml | 7 ++- 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml diff --git a/rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml b/rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml new file mode 100644 index 000000000..434a8da6a --- /dev/null +++ b/rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml @@ -0,0 +1,49 @@ +[metadata] +creation_date = "2020/09/01" +ecs_version = ["1.6.0"] +maturity = "production" +updated_date = "2020/09/01" + +[rule] +author = ["Elastic"] +description = """ +Identifies when an Azure Conditional Access policy is modified. Azure Conditional Access policies control access to +resources via if-then statements. For example, if a user wants to access a resource, then they must complete an action +such as using multi-factor authentication to access it. An adversary may modify a Conditional Access policy in order to +weaken their target's security controls. +""" +from = "now-25m" +index = ["filebeat-*"] +language = "kuery" +license = "Elastic License" +name = "Azure Conditional Access Policy Modified" +note = "The Azure Filebeat module must be enabled to use this rule." +references = ["https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview"] +risk_score = 47 +rule_id = "bc48bba7-4a23-4232-b551-eca3ca1e3f20" +severity = "medium" +tags = ["Elastic", "Azure", "Continuous Monitoring", "SecOps", "Configuration Audit"] +type = "query" + +query = ''' +event.module:azure and event.dataset:(azure.activitylogs or azure.auditlogs) and + ( + azure.activitylogs.operation_name:"Update policy" or + azure.auditlogs.operation_name:"Update policy" + ) and + event.outcome:success +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1098" +name = "Account Manipulation" +reference = "https://attack.mitre.org/techniques/T1098/" + + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" diff --git a/rules/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml b/rules/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml index 08d38edbb..8e18face9 100644 --- a/rules/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml +++ b/rules/azure/initial_access_consent_grant_attack_via_azure_registered_application.toml @@ -31,7 +31,12 @@ tags = ["Elastic", "Azure", "Continuous Monitoring", "SecOps", "Identity and Acc type = "query" query = ''' -event.module:azure and event.dataset:azure.activitylogs and event.category:Administrative and azure.activitylogs.operation_name:"Consent to application" and event.outcome:success +event.module:azure and event.dataset:(azure.activitylogs or azure.auditlogs) and + ( + azure.activitylogs.operation_name:"Consent to application" or + azure.auditlogs.operation_name:"Consent to application" + ) and + event.outcome:success '''