Detection: Azure AD Guest User Type Changed To Member

Description

The following analytic detects when an Azure AD guest user account has its UserType property changed from Guest to Member. It leverages Azure Active Directory AuditLogs for the "Update user" operation and compares the UserType modifiedProperty old and new values. A legacy account whose UserType was null is not a guest promotion and does not match. Guest accounts carry inherent restrictions on tenant resource access; elevating to Member removes those restrictions. If confirmed malicious, this activity indicates an attacker is expanding the capabilities of a compromised or attacker-controlled guest account to gain broader access to tenant resources.

Search

 1`azure_monitor_aad`
 2category=AuditLogs
 3operationName="Update user"
 4properties.targetResources{}.modifiedProperties{}.displayName="UserType"
 5properties.targetResources{}.modifiedProperties{}.oldValue=*Guest*
 6properties.targetResources{}.modifiedProperties{}.newValue=*Member*
 7
 8
 9| rename properties.* as *
10
11| rename initiatedBy.user.userPrincipalName as initiatedBy
12
13| rename initiatedBy.app.displayName as initiatedByApp
14
15
16| eval actor = coalesce(initiatedBy, initiatedByApp)
17
18
19| rename targetResources{}.userPrincipalName as targetUser
20
21| rename userAgent as user_agent
22
23
24| eval index_number = mvfind('targetResources{}.modifiedProperties{}.displayName', "UserType")
25
26| eval oldUserType = mvindex('targetResources{}.modifiedProperties{}.oldValue', index_number)
27
28| eval newUserType = mvindex('targetResources{}.modifiedProperties{}.newValue', index_number)
29
30
31| search oldUserType="*Guest*" newUserType="*Member*"
32
33
34| fillnull value="unknown" dest src vendor_account vendor_product user_agent actor targetUser oldUserType newUserType signature
35
36
37| stats count min(_time) as firstTime
38              max(_time) as lastTime
39  BY dest src vendor_account vendor_product user_agent
40     actor targetUser oldUserType newUserType signature
41
42
43| rename actor as user
44
45
46| `security_content_ctime(firstTime)`
47
48| `security_content_ctime(lastTime)`
49
50| `azure_ad_guest_user_type_changed_to_member_filter`

Data Source

Name	Platform	Sourcetype	Source
Azure Active Directory Update user	Azure	'azure:monitor:aad'	'Azure AD'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.

Known False Positives

Legitimate conversion of a guest account to a member account can occur when a contractor becomes a full-time employee or when an organization consolidates external identities. Validate the actor, target user, and whether a change management record exists for the conversion.

Associated Analytic Story

• Azure Active Directory Privilege Escalation

• Azure Active Directory Persistence

Finding

Intermediate Findings

References

• https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions

• https://attack.mitre.org/techniques/T1098/

• https://learn.microsoft.com/en-us/entra/identity/users/users-restrict-guest-permissions

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1