Try in Splunk Security Cloud

Description

This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system.

  • Type: TTP
  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • Last Updated: 2021-07-19
  • Author: Bhavin Patel, Splunk
  • ID: c783dd98-c703-4252-9e8a-f19d9f66949e

ATT&CK

ID Technique Tactic
T1562.007 Disable or Modify Cloud Firewall Defense Evasion
T1562 Impair Defenses Defense Evasion
`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy 
| rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" 
| rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" 
| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") 
| mvexpand ip_addresses_new_added 
| where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) 
|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_bypass_mfa_via_trusted_ip_filter`

Associated Analytic Story

How To Implement

You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity

Required field

  • _time
  • signature
  • ModifiedProperties{}.Name
  • ModifiedProperties{}.NewValue
  • ModifiedProperties{}.OldValue
  • user
  • vendor_account
  • status
  • user_id
  • action

Kill Chain Phase

  • Actions on Objective

Known False Positives

Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.

RBA

Risk Score Impact Confidence Message
42.0 70 60 User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2