Detection: Azure AD Temporary Access Pass Created

Description

The following analytic detects the creation of a Temporary Access Pass (TAP) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user" operation. TAPs are time-limited passcodes that bypass all authentication requirements including MFA and FIDO2 - an attacker who creates a TAP for a compromised account can sign in from any location without any additional factor. If confirmed malicious, this activity provides an attacker with an unchallenged authentication path into the affected account.

Search

 1`azure_monitor_aad`
 2category=AuditLogs
 3operationName="Create Temporary Access Pass method for user"
 4properties.result="success"
 5
 6
 7| rename properties.* as *
 8
 9| rename initiatedBy.user.userPrincipalName as initiatedBy
10
11| rename initiatedBy.app.displayName as initiatedByApp
12
13
14| eval actor = coalesce(initiatedBy, initiatedByApp)
15
16
17| rename targetResources{}.userPrincipalName as targetUser
18
19| rename userAgent as user_agent
20
21
22| fillnull
23
24
25| stats count min(_time) as firstTime
26              max(_time) as lastTime
27  BY dest user src vendor_account vendor_product user_agent
28     actor targetUser signature
29
30
31| rename actor as user
32
33
34| `security_content_ctime(firstTime)`
35
36| `security_content_ctime(lastTime)`
37
38| `azure_ad_temporary_access_pass_created_filter`

Data Source

Name	Platform	Sourcetype	Source
Azure Active Directory	Azure	'azure:monitor:aad'	'Azure AD'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.

Known False Positives

IT administrators legitimately create TAPs for users who are locked out or onboarding a new passwordless authentication method. The key differentiators are the actor and timing -- a helpdesk account creating a TAP for a user who just reported a lockout is expected; an unfamiliar actor creating a TAP outside business hours or for a high-privilege account warrants investigation.

Associated Analytic Story

• Azure Active Directory Account Takeover

• Azure Active Directory Persistence

Finding

Intermediate Findings

References

• https://attack.mitre.org/techniques/T1556/006/

• https://attack.mitre.org/techniques/T1078/004/

• https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass

• https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1