Try in Splunk Security Cloud

Description

Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • Last Updated: 2022-08-17
  • Author: Mauricio Velazco, Splunk
  • ID: dca983db-6334-4a0d-be32-80611ca1396c

Narrative

Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants.

Detections

Name Technique Type
Azure AD External Guest User Invited Cloud Account TTP
Azure AD Global Administrator Role Assigned Additional Cloud Roles TTP
Azure AD New Custom Domain Added Domain Policy Modification, Domain Trust Modification TTP
Azure AD New Federated Domain Added Domain Policy Modification, Domain Trust Modification TTP
Azure AD Privileged Role Assigned Account Manipulation, Additional Cloud Roles TTP
Azure AD Service Principal Created Cloud Account TTP
Azure AD Service Principal New Client Credentials Account Manipulation, Additional Cloud Credentials TTP
Azure AD Service Principal Owner Added Account Manipulation TTP
Azure AD User Enabled And Password Reset Account Manipulation TTP
Azure AD User ImmutableId Attribute Updated Account Manipulation TTP
Azure Automation Account Created Create Account, Cloud Account TTP
Azure Automation Runbook Created Create Account, Cloud Account TTP
Azure Runbook Webhook Created Valid Accounts, Cloud Accounts TTP

Reference

source | version: 1