Analytics Story: Azure Active Directory Persistence

Description

Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.

Why it matters

Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants.

Detections

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Azure Active Directory	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Add member to role	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Add owner to application	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Add service principal	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Add unverified domain	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Consent to application	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Enable account	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Invite external user	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Reset password (by admin)	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Set domain authentication	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Update application	Azure	azure:monitor:aad	Azure AD
Azure Active Directory Update user	Azure	azure:monitor:aad	Azure AD
Azure Audit Create or Update an Azure Automation Runbook	Azure	mscs:azure:audit	mscs:azure:audit
Azure Audit Create or Update an Azure Automation account	Azure	mscs:azure:audit	mscs:azure:audit
Azure Audit Create or Update an Azure Automation webhook	Azure	mscs:azure:audit	mscs:azure:audit
Windows Event Log Security 4724	Windows	xmlwineventlog	XmlWinEventLog:Security
Windows Event Log Security 4725	Windows	xmlwineventlog	XmlWinEventLog:Security
Windows Event Log Security 4726	Windows	xmlwineventlog	XmlWinEventLog:Security

References

• https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis
• https://azure.microsoft.com/en-us/services/active-directory/#overview
• https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad
• https://attack.mitre.org/tactics/TA0003/
• https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/

Source: GitHub | Version: 2