Detection: Azure AD Service Principal Enumeration

Updated Date: 2025-01-06 ID: 3f0647ce-add5-4436-8039-cbd1abe74563 Author: Dean Luxton Type: TTP Product: Splunk Enterprise Security

Description

This detection leverages azure graph activity logs to identify when graph APIs have been used to identify 10 or more service principals. This type of behaviour is associated with tools such as Azure enumberation tools such as AzureHound or ROADtools.

1`azure_monitor_aad` category IN (MicrosoftGraphActivityLogs) TERM(servicePrincipals) 
2| fillnull 
3| rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/beta\/servicePrincipals\/(?P<servicePrincipalb>.*?)\/" 
4| rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/v1.0\/servicePrincipals\/(?P<servicePrincipalv1>.*?)\/" 
5| eval spn=coalesce(servicePrincipalb,servicePrincipalv1) 
6| stats count min(_time) as _time dc(spn) as spn_count values(user_id) as user_id by src tenantId properties.userAgent 
7| rename properties.userAgent as user_agent 
8| where spn_count>9 
9| `azure_ad_service_principal_enumeration_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name Value
azure_monitor_aad sourcetype=azure:monitor:aad
azure_ad_service_principal_enumeration_filter search *
azure_ad_service_principal_enumeration_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1087.004 Cloud Account Discovery
T1526 Cloud Service Discovery Discovery
Exploitation
DE.CM
CIS 10
APT29

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

Run this detection over historical data to identify then tune out any known services which may be performing this action. Thresholds can be lowered or raised to meet requirements. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest MicrosoftGraphActivityLogs via Azure EventHub. See reference for links for further details on how to onboard this log source.

Known False Positives

Unknown

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

$spn_count$ Service Principals have been enumerated by $user_id$ from IP $src$

Risk Object Risk Object Type Risk Score Threat Objects
tenantId other 80 src, user_agent

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset Azure AD azure:monitor:aad
Integration ✅ Passing Dataset Azure AD azure:monitor:aad

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1