Try in Splunk Security Cloud

Description

The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment. Attackers who are looking to escalate their privileges by leveraging a Service Principals permissions may also add a new owner.

  • Type: TTP

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2022-08-30
  • Author: Mauricio Velazco, Splunk
  • ID: 7ddf2084-6cf3-4a44-be83-474f7b73c701

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1098 Account Manipulation Persistence
Kill Chain Phase
  • Installation
NIST
  • DE.CM
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6
7
8
9



 `azuread` body.operationName="Add owner to application" 
| rename body.properties.* as * 
| rename initiatedBy.user.userPrincipalName as initiatedBy 
| rename targetResources{}.userPrincipalName as newOwner 
| rename targetResources{}.modifiedProperties{}.newValue as displayName 
| eval displayName = mvindex(displayName,1) 
| where  initiatedBy!=newOwner 
| stats values(displayName) by _time, initiatedBy, result, body.operationName, newOwner 
| `azure_ad_service_principal_owner_added_filter`

Macros

The SPL above uses the following Macros:

:information_source: azure_ad_service_principal_owner_added_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • body.operationName
  • body.properties.initiatedBy.user.userPrincipalName
  • body.properties.targetResources{}.userPrincipalName
  • body.properties.targetResources{}.modifiedProperties{}.newValue
  • body.propertiesresult

How To Implement

You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.

Known False Positives

Administrator may legitimately add new owners for Service Principals. Filter as needed.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
54.0 60 90 A new owner was added for service principal $displayName$ by $initiatedBy$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2