azure active directory

Title	Tags
a source ip failing to authenticate with multiple users is not a common for legitimate behavior.	t1110 T1110.003 T1110.004 t1586 t1586.003 azure active directory splunk
administrative users will likely use powershell commandlets to troubleshoot and maintain the environment. filter as needed.	t1078 t1078.004 t1586 t1586.003 azure active directory splunk
administrator may legitimately add new owners for service principals. filter as needed.	t1098 azure active directory splunk
administrator may legitimately create service principal. filter as needed.	t1136.003 azure active directory splunk
administrator may legitimately invite external guest users. filter as needed.	t1136.003 azure active directory splunk
administrators may legitimately assign the application administrator role to a user. filter as needed.	t1098 t1098.003 azure active directory splunk
administrators may legitimately assign the global administrator role to a user. filter as needed.	t1098.003 azure active directory splunk
administrators may legitimately assign the privileged authentication administrator role as part of administrative tasks. filter as needed.	t1003.002 azure active directory splunk
administrators may legitimately assign the privileged roles to service principals as part of administrative tasks. filter as needed.	t1098 t1098.003 azure active directory splunk
administrators will legitimately assign the privileged roles users as part of administrative tasks. filter as needed.	t1098 t1098.003 azure active directory splunk
although not recommended, certain users may be required without multi-factor authentication. filter as needed	t1078 t1078.004 t1586 t1586.003 azure active directory google cloud platform tenant splunk
as part of legitimate administrative behavior, users may activate pim roles. filter as needed	t1098 t1098.003 azure active directory splunk
as part of legitimate administrative behavior, users may be assigned pim roles. filter as needed	t1098 t1098.003 azure active directory splunk
certain users or applications may create multiple service principals in a short period of time for legitimate purposes. filter as needed.	t1136.003 o365 tenant azure active directory splunk
details for the risk calculation algorithm used by identity protection are unknown and may be prone to false positives.	t1110 T1110.003 t1586 t1586.003 azure active directory splunk
in most organizations, domain federation settings will be updated infrequently. filter as needed.	t1484 T1484.002 azure active directory splunk
in most organizations, new customm domains will be updated infrequently. filter as needed.	t1484 T1484.002 azure active directory splunk
legitimate use case may require for users to disable mfa. filter as needed.	t1556 t1556.006 t1586 t1586.003 gcp azure active directory splunk
legitimate users may miss to reply the mfa challenge within the time window or deny it by mistake.	t1078 t1078.004 t1586 t1586.003 t1621 aws account azure active directory google cloud platform tenant splunk
multiple denifed mfa requests in a short period of span may also be a sign of authentication errors. investigate and filter as needed.	t1621 azure active directory splunk
multiple failed mfa requests may also be a sign of authentication or application issues. filter as needed.	t1078 t1078.004 t1586 t1586.003 t1621 google cloud platform tenant o365 tenant azure active directory aws account splunk
newly onboarded users who are registering an mfa method for the first time will also trigger this detection.	t1556 t1556.006 azure active directory aws account splunk
privileged graph api permissions may be assigned for legitimate purposes. filter as needed.	t1003.002 azure active directory o365 tenant splunk
service principal client credential modifications may be part of legitimate administrative operations. filter as needed.	t1098 t1098.001 azure active directory o365 tenant splunk
service principals are sometimes configured to legitimately bypass the consent process for purposes of automation. filter as needed.	t1098.003 azure active directory o365 tenant splunk
service principals will legitimally authenticate remotely to your tenant. implementing this detection after establishing a baseline enables a more accurate identification of security threats, ensuring proactive and informed responses to safeguard the azure ad environment. source ips.	t1078.004 azure active directory splunk
the full_access_as_app api permission may be assigned to legitimate applications. filter as needed.	T1098.002 t1098.003 o365 tenant azure active directory splunk
the sourceanchor (also called immutableid) azure ad attribute has legitimate uses for directory synchronization. investigate and filter as needed.	t1098 azure active directory splunk
while not common, administrators may enable accounts and reset their passwords for legitimate reasons. filter as needed.	t1098 azure active directory splunk