[New Rule] Azure Conditional Access Policy Modified#237
Conversation
rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Could we add a technique like Account Manipulation to this? event.outcome didn't appear to populate when I looked at the results during our test, not sure if that is everytime though. What about adding azure.activitylogs.properties.result:success?
update - event outcome doesn't populate with all activitylogs
…dified.toml Update maturity to production Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
I added the ATT&CK metadata to the rule. Let me check on the ECS mapping before I include that non-ECS field in the rule. Thanks |
rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml
Show resolved
Hide resolved
|
See Beats issue elastic/beats#20990 re an update that's required for us to use Confirmed that the updated query matches the expected events, but the tests are failing when I add
|
…ttps://github.com/threat-punter/detection-rules into new-rule-azure-conditional-access-policy-modified
rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml
Outdated
Show resolved
Hide resolved
|
This rule can be merged when elastic/beats#20990 is resolved. |
|
PR elastic/beats#20998 has been merged to ensure that field |
|
We should update this to account for the AuditLogs as well |
rules/azure/defense_evasion_azure_conditional_access_policy_modified.toml
Outdated
Show resolved
Hide resolved
Amending the query in rule, "Possible Consent Grant Attack via Azure-Registered Application" to search both the Azure activity and audit logs
|
I took the liberty of tweaking rule, I'll request a review of this PR again, but I did confirm that both queries in this PR match the intended events. |
bm11100
left a comment
There was a problem hiding this comment.
lgtm, with the changes going into 7.10 the activity logs will eval true as well
Issues
Resolves #143
Summary
Identifies when an Azure Conditional Access policy is modified. Azure Conditional Access policies control access to resources via if-then statements. For example, if a user wants to access a resource, then they must complete an action such as using multi-factor authentication to access it. An adversary may modify a Conditional Access policy in order to weaken their target's security controls.
Contributor checklist