update detection

detections/cloud/o365_multiple_appids_and_useragents_authentication_spike.yml

@@ -6,23 +6,26 @@ author: Mauricio Velazco, Splunk
 status: production
 type: Anomaly
 data_source: []
-description: UPDATE_DESCRIPTION
+description: This analytic is crafted to identify unusual and potentially malicious authentication activity within an Azure AD environment. It triggers when a single user account is involved in more than 8 authentication attempts, using 3 or more unique application IDs and more than 5 unique user agents within a short timeframe. This pattern is atypical for regular user behavior and may indicate an adversary’s attempt to probe the environment, testing for multi-factor authentication requirements across different applications and platforms. The detection is based on analysis of O365 audit logs, specifically focusing on authentication events. It employs statistical thresholds to highlight instances where the volume of authentication attempts and the diversity of application IDs and user agents associated with a single user account exceed normal parameters. Identifying this behavior is crucial as it provides an early indication of potential account compromise. Adversaries, once in possession of user credentials, often conduct reconnaissance to understand the security controls in place, including multi-factor authentication configurations. Tools like Invoke-MFASweep are commonly used for this purpose, automating the process of testing different user agents and application IDs to bypass MFA. By detecting these initial probing attempts, security teams can swiftly respond, potentially stopping an attack in its early stages and preventing further unauthorized access. This proactive stance is vital for maintaining the integrity of the organization’s security posture. If validated as a true positive, this detection points to a compromised account, signaling that an attacker is actively attempting to navigate security controls to maintain access and potentially escalate privileges. This could lead to further exploitation, lateral movement within the network, and eventual data exfiltration. Recognizing and responding to this early stage of an attack is vital for preventing substantial harm and safeguarding sensitive organizational data and systems.
 search: ' `o365_management_activity` Workload=AzureActiveDirectory (Operation=UserLoggedIn OR Operation=UserLoginFailed)
   | bucket span=5m _time
   | stats  dc(_raw) as failed_attempts dc(ApplicationId) as unique_app_ids dc(UserAgent) as unique_user_agents values(ApplicationId) values(OS) by _time user src_ip
   | where failed_attempts > 5 and unique_user_agents > 5 and unique_app_ids > 2
   | `o365_multiple_appids_and_useragents_authentication_spike_filter`'
-how_to_implement: UPDATE_HOW_TO_IMPLEMENT
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
+known_false_positives: Rapid authentication from the same user using more than 5 different user agents and 3 application IDs is highly unlikely under normal circumstances. However, there are potential scenarios that could lead to false positives.
 references:
+- https://attack.mitre.org/techniques/T1078/
+- https://www.blackhillsinfosec.com/exploiting-mfa-inconsistencies-on-microsoft-services/
 - https://github.com/dafthack/MFASweep
+- https://www.youtube.com/watch?v=SK1zgqaAZ2E
 tags:
   analytic_story:
   - O365 Identity Compromise Techniques
   asset_type: Office 365 
   confidence: 80
   impact: 60
-  message: UPDATE message
+  message: $user$ authenticated in a short period of time with more than 5 different user agents across 3 or more unique application ids.
   mitre_attack_id:
   - T1078
   observable:
@@ -37,6 +40,11 @@ tags:
   risk_score: 48
   required_fields:
   - _time
+  - Workload
+  - Operation
+  - ApplicationId
+  - UserAgent
+  - OS
   security_domain: identity
 tests:
 - name: True Positive Test