O365 Bypass MFA via Trusted IP
Description
This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.
- Type: TTP
- Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Datamodel: Authentication
- Last Updated: 2022-02-03
- Author: Bhavin Patel, Splunk
- ID: c783dd98-c703-4252-9e8a-f19d9f66949e
Annotations
ATT&CK
Kill Chain Phase
- Exploitation
NIST
- DE.CM
CIS20
- CIS 10
CVE
Search
1
2
3
4
5
6
7
8
9
10
`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0")
| mvexpand ip_addresses_new_added
| where isnull(mvfind(ip_addresses_old,ip_addresses_new_added))
|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added Operation Workload vendor_account status user_id action
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_bypass_mfa_via_trusted_ip_filter`
Macros
The SPL above uses the following Macros:
o365_bypass_mfa_via_trusted_ip_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Required fields
List of fields required to use this analytic.
- _time
- signature
- ModifiedProperties{}.Name
- ModifiedProperties{}.NewValue
- ModifiedProperties{}.OldValue
- user
- vendor_account
- status
- user_id
- action
How To Implement
You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity
Known False Positives
Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
Associated Analytic Story
RBA
Risk Score | Impact | Confidence | Message |
---|---|---|---|
42.0 | 70 | 60 | User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA |
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
Reference
- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
- https://attack.mitre.org/techniques/T1562/007/
Test Dataset
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
source | version: 2