Skip to content

Commit

Permalink
updating o365
Browse files Browse the repository at this point in the history
  • Loading branch information
mvelazc0 committed Oct 30, 2023
1 parent 1100e9c commit ce6d21a
Showing 1 changed file with 16 additions and 9 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,8 @@ date: '2023-10-26'
author: Mauricio Velazco, Splunk
status: production
type: TTP
data_source:
- UPDATE_DATA_SOURCE
description: UPDATE_DESCRIPTION
data_source: []
description: This analytic detects when the "risk-based step-up consent" security setting in Microsoft 365 is disabled. This setting, when enabled, prevents regular users from granting consent to potentially malicious OAuth applications, requiring an administrative "step-up" for consent instead. Disabling this feature could expose the organization to OAuth phishing threats.The detection operates by monitoring Azure Active Directory logs for events where the "Update authorization policy" operation is performed. It specifically looks for changes to the "AllowUserConsentForRiskyApps" setting, identifying instances where this setting is switched to "true," effectively disabling the risk-based step-up consent. Monitoring for changes to critical security settings like the "risk-based step-up consent" is vital for maintaining the integrity of an organization’s security posture. Disabling this feature can make the environment more susceptible to OAuth phishing attacks, where attackers trick users into granting permissions to malicious applications. Identifying when this setting is disabled can help blue teams to quickly respond, investigate, and potentially uncover targeted phishing campaigns against their users. If an attacker successfully disables the "risk-based step-up consent" and subsequently launches an OAuth phishing campaign, they could gain unauthorized access to user data and other sensitive information within the M365 environment. This could lead to data breaches, unauthorized access to emails, and potentially further compromise within the organization.
search: >
`o365_management_activity` Workload=AzureActiveDirectory Operation="Update authorization policy."
| eval index_number = if(mvfind('ModifiedProperties{}.Name', "AllowUserConsentForRiskyApps") >= 0, mvfind('ModifiedProperties{}.Name', "AllowUserConsentForRiskyApps"), -1)
Expand All @@ -18,16 +17,18 @@ search: >
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_block_user_consent_for_risky_apps_disabled_filter`
how_to_implement: UPDATE_HOW_TO_IMPLEMENT
known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Legitimate changes to the 'risk-based step-up consent' setting by administrators, perhaps as part of a policy update or security assessment, may trigger this alert, necessitating verification of the change's intent and authorization.
references:
- REFERENCE
- https://attack.mitre.org/techniques/T1562/
- https://goodworkaround.com/2020/10/19/a-look-behind-the-azure-ad-permission-classifications-preview/
- https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-risk-based-step-up-consent
- https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
tags:
analytic_story:
- UPDATE_STORY_NAME
asset_type: UPDATE asset_type
atomic_guid:
- UPDATE atomic_guid
asset_type: O365 tenant
atomic_guid: []
confidence: 50
impact: 60
message: UPDATE message
Expand All @@ -45,6 +46,12 @@ tags:
risk_score: 30
required_fields:
- _time
- Workload
- Operation
- ModifiedProperties{}.Name
- ModifiedProperties{}.NewValue
- user
- user_agent
security_domain: audit
tests:
- name: True Positive Test
Expand Down

0 comments on commit ce6d21a

Please sign in to comment.