Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New Azure AD Detections #2799

Closed
wants to merge 91 commits into from
Closed

New Azure AD Detections #2799

wants to merge 91 commits into from

Conversation

mvelazc0
Copy link
Contributor

@mvelazc0 mvelazc0 commented Aug 3, 2023 •
edited

Details

What does this PR have in it? Screenshots are worth 1000 words 😄

New Detections

  • Azure AD Device Code Authentication
  • Azure AD Tenant Wide Admin Consent Granted
  • Azure AD Multiple AppIDs and UserAgents Authentication Spike
  • Azure AD Block User Consent For Risky Apps Disabled
  • Azure AD User Consent Blocked for Risky Application
  • Azure AD OAuth Application Consent Granted By User
  • Azure AD User Consent Denied for OAuth Application
  • Azure AD New MFA Method Registered
  • Azure AD Multiple Denied MFA Requests For User
  • Azure AD Multi-Source Failed Authentications Spike

Updated Detections

  • Azure AD Multiple Failed MFA Requests For User

Checklist

  • Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
  • CI/CD jobs passed ✔️
  • Validated SPL logic.
  • Validated tags, description, and how to implement.
  • Verified references match analytic.

@mvelazc0 mvelazc0 added the WIP DO NOT MERGE Work in Progress label Aug 7, 2023
srv-rr-gh-researchbt and others added 22 commits August 8, 2023 09:49
mvelazc0 and others added 29 commits October 26, 2023 13:07
@mvelazc0
updating detections
92cf159
@mvelazc0
adding new detection
dcc7081
@srv-rr-gh-researchbt
Branch was auto-updated.
792e695
@srv-rr-gh-researchbt
Branch was auto-updated.
095838e
@mvelazc0
adding detection
b5acee8
@mvelazc0
updating macro. adding new detection.
b4356da
@mvelazc0
update sourcetype
15453d5
@mvelazc0
new detection
cff4168
@mvelazc0
updates
a62bde4
@mvelazc0
adding detection
d2e1de3
@mvelazc0
adding detection
31d2d20
@mvelazc0
update detection
77b591f
@mvelazc0
Update azure_ad_multiple_denied_mfa_requests_for_user.yml
1ff4ed0
@srv-rr-gh-researchbt
Branch was auto-updated.
8a0f56b
@mvelazc0
updating detections
1741f91
@mvelazc0
Merge branch 'TR_3232_azure_ad' of github.com:splunk/security_content…
43f748d 
… into TR_3232_azure_ad
@srv-rr-gh-researchbt
Branch was auto-updated.
5f61268
@mvelazc0
Update azure_ad_multiple_failed_mfa_requests_for_user.yml
7b501ac
@mvelazc0
Merge branch 'TR_3232_azure_ad' of github.com:splunk/security_content…
e7b504d 
… into TR_3232_azure_ad
@pyth0n1c
add some testing
a08846e
@pyth0n1c
can't run poetry shell in github
304ae9a
@pyth0n1c
forgot to add checkout
7c76a97
@pyth0n1c
fix spacing
96d7006
@pyth0n1c
Fix observable issues, unicode characters,
51a3b86 
and newline issues in detections.
@pyth0n1c
More minor testing fixes
6d6a603
@pyth0n1c
fix pathing
f77422a
@mvelazc0
adding new detection
7776ce8
@mvelazc0
update detection
5070105
@mvelazc0
updating hunting query
8c0c057
@mvelazc0 mvelazc0 closed this Dec 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@patel-bhavin patel-bhavin patel-bhavin left review comments

@P4T12ICK P4T12ICK Awaiting requested review from P4T12ICK P4T12ICK is a code owner

Assignees
No one assigned
Labels
WIP DO NOT MERGE Work in Progress
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@mvelazc0 @patel-bhavin @srv-rr-gh-researchbt @gowthamarajr @pyth0n1c