Add Azure AD Entra ID identity attack detections (3 analytics)#4091
Add Azure AD Entra ID identity attack detections (3 analytics)#4091descambiado wants to merge 5 commits into
Conversation
Detects TAP creation for Azure AD users via AuditLogs. TAPs bypass all authentication requirements including MFA and FIDO2. Covers T1556.006 and T1078.004.
Detects UserType property changes from Guest to Member in Azure AD via Update user AuditLogs. Uses mvfind/mvindex to filter modifiedProperties. Covers T1098.
Detects federated credential additions to service principals via Update service principal AuditLogs. Workload identity federation enables secretless external OIDC authentication as the SP. Covers T1098.001.
descambiado
requested review from
ljstella,
nasbench and
patel-bhavin
as code owners
azure_ad_federated_identity_credential_added_to_sp: filter macro renamed from azure_ad_federated_identity_credential_added_to_sp_filter to azure_ad_federated_identity_credential_added_to_service_principal_filter to match the detection name field as required by appinspect. azure_ad_temporary_access_pass_created: data_source updated from the non-existent "Create Temporary Access Pass method for user" catalog entry to the valid "Azure Active Directory Update user" entry.
|
Addressed the two appinspect failures from CI: azure_ad_federated_identity_credential_added_to_sp: Filter macro renamed from azure_ad_temporary_access_pass_created: The |
|
Hey @ljstella, just checking in to see if there is anything blocking the review or if you need any additional info from my side. Happy to help! |
|
Hey @descambiado - thanks for checking in, and apologies for the delay on our side. We've been rather busy getting ESCU v6.0.0 out the door. Unfortunately, there's been some rather large changes to the repo as part of the release of ESCU v6.0.0 that are going to cause some issues here, including a new format of the detection yaml files. Additionally, the unit-testing no longer works from forks at the moment. I'm going to update this with the latest changes from |
|
Hey @ljstella, no worries at all, congrats on the v6.0.0 release! I'll wait for you to update the branch and then happy to work through whatever structural changes are needed. Just let me know what to update once it's rebased. |
2 participants
Details
Three new TTP analytics covering Azure AD / Entra ID identity attack techniques that are not currently in the repository.
azure_ad_temporary_access_pass_created.ymlDetects creation of a Temporary Access Pass for an Azure AD user via the
Create Temporary Access Pass method for userAuditLog operation. TAPs are time-limited passcodes that bypass MFA and FIDO2 — an attacker who gains admin access and creates a TAP for a target account can authenticate without any second factor. Covers T1556.006, T1078.004. Risk score 70 on targetUser.azure_ad_guest_user_type_changed_to_member.ymlDetects when a guest account's UserType property is changed to Member via
Update user. Usesmvfind/mvindexto filter on theUserTypemodifiedProperty, consistent with the pattern used inazure_ad_block_user_consent_for_risky_apps_disabled. Removing guest restrictions gives a compromised external identity broader access to tenant resources. Covers T1098.azure_ad_federated_identity_credential_added_to_sp.ymlDetects federated identity credential additions to service principals via
Update service principalwhereFederatedIdentityCredentialsappears in modifiedProperties. Workload identity federation allows external OIDC workloads (GitHub Actions, Kubernetes) to authenticate as the SP without a secret — an attacker who adds a federated credential pointing to a controlled OIDC issuer gains a persistent secretless authentication path invisible to standard credential monitoring. Covers T1098.001.Checklist
<platform>_<mitre att&ck technique>_<short description>nomenclature (azure_ad prefix, descriptive name consistent with existing detections)Notes For Submitters and Reviewers
CLA: I have not yet signed the Splunk individual contributors agreement. I will complete this at https://www.splunk.com/goto/individualcontributions before this PR is reviewed.
Attack data: Test data files for these three techniques do not yet exist in splunk/attack_data. The
tests.attack_dataURLs follow the established naming pattern but point to datasets that need to be contributed separately. Happy to contribute the attack data in a follow-up PR to splunk/attack_data once the detection logic is reviewed and approved.SPL pattern: The
azure_ad_guest_user_type_changed_to_memberandazure_ad_federated_identity_credential_added_to_spanalytics use themvfind/mvindexpattern formodifiedPropertiesarray filtering, consistent withazure_ad_block_user_consent_for_risky_apps_disabled.