Merge PR SigmaHQ#4725 from @cyb3rjy0t - Add new Azure AD rules

new: Certificate-Based Authentication Enabled new: New Root Certificate Authority Added --------- Co-authored-by: nasbench <[email protected]>
deFr0ggy · Mar 26, 2024 · 16d8345 · 16d8345
1 parent 8cbcaea
commit 16d8345
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 0 deletions.
diff --git a/rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml b/rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml
@@ -0,0 +1,24 @@
+title: Certificate-Based Authentication Enabled
+id: c2496b41-16a9-4016-a776-b23f8910dc58
+status: test
+description: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
+references:
+    - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
+    - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
+author: Harjot Shah Singh, '@cyb3rjy0t'
+date: 2024/03/26
+tags:
+    - attack.persistence
+    - attack.privilege_escalation
+    - attack.t1556
+logsource:
+    product: azure
+    service: auditlogs
+detection:
+    selection:
+        OperationName: 'Authentication Methods Policy Update'
+        TargetResources.modifiedProperties|contains: 'AuthenticationMethodsPolicy'
+    condition: selection
+falsepositives:
+    - Unknown
+level: medium
diff --git a/rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml b/rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml
@@ -0,0 +1,24 @@
+title: New Root Certificate Authority Added
+id: 4bb80281-3756-4ec8-a88e-523c5a6fda9e
+status: test
+description: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
+references:
+    - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
+    - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
+author: Harjot Shah Singh, '@cyb3rjy0t'
+date: 2024/03/26
+tags:
+    - attack.persistence
+    - attack.privilege_escalation
+    - attack.t1556
+logsource:
+    product: azure
+    service: auditlogs
+detection:
+    selection:
+        OperationName: 'Set Company Information'
+        TargetResources.modifiedProperties.newValue|contains: 'TrustedCAsForPasswordlessAuth'
+    condition: selection
+falsepositives:
+    - Unknown
+level: medium