LoFP LoFP / t1087

t1087

TitleTags
a corporate nat, jump host, or ci runner that is not in the excluded asn list can send `getcalleridentity` for several iam users from one ip. confirm the source ip, user agent, and user list against approved automation before treating the activity as malicious.
a developer or operator legitimately running first-party tooling under the device-code flow that then enumerates directory objects during onboarding or troubleshooting. validate the calling app and source ip and exclude as appropriate.
a legitimate application that has been deleted from the tenant while a client continues to authenticate against its former client id via ropc can generate error code 700016. a misconfigured legacy client submitting an incorrect client id is also possible. in both cases the client id is typically stable and low-volume, unlike the many distinct or randomized identifiers seen in spoofing. verify the application identifier, the source infrastructure, and whether the same principal is targeted by many different unresolved client ids.
administrative activity
administrator activity
administrators and developers may legitimately acquire tokens and use them with powershell, command-line tools, or custom scripts to query microsoft graph. confirm that the client application, account, enumeration target, and timing are expected before escalating.
administrators configuring new users.
administrators or automated systems may legitimately perform multiple `describe`, `list`, `get` and `generate` api calls in a short time frame. verify the user identity and the purpose of the api calls to determine if the behavior is expected.
administrators run these commands during inventory, troubleshooting, and support. review whether the same session continues into virtual machine shutdown, snapshot removal, or a datastore search.
adws is used by a number of legitimate applications that need to interact with active directory. these applications should be added to the allow-listing to avoid false positives.
another tool that uses the command line switches of psloglist
application onboarding, directory synchronization, inventory tools, and permission-validation scripts may query multiple directory collections and encounter expected access denials.
authorized administrative activity
authorized red team activity exercising roadrecon. document the engagement window and add exceptions on the source ip or calling user.
authorized red team activity. document and add exceptions on the user, app id, or source ip.
authorized red team or audit activity (roadrecon, roadtools, aadinternals, roadtx). document the engagement window and add exceptions on the calling user.
authorized red team or audit activity. add exceptions on the calling user after review.
authorized red team or penetration test activity using roadrecon, roadtools, aadinternalsor similar tooling can match. add exceptions on the source ip, signed-in user, or app id after validation.
commonly run by administrators
developer activity prototyping against aad graph from a workstation may match. validate via the calling `azure.aadgraphactivitylogs.properties.app_id` and the signed-in user; legitimate developer use is rare in production tenants since microsoft has been steering callers off aad graph for years.
developer activity using aiohttp or python http libraries against aad graph for prototyping. rare in production tenants and typically low-volume.
expected red team assessments or penetration tests may utilize bloodhound tools to evaluate the security posture of azure or microsoft 365 environments. if this is expected behavior, consider adjusting the rule or adding exceptions for specific ip addresses, registered applications, jwt tokens, prts or user principal names (upns).
expected red team assessments or penetration tests may utilize teamfiltration to evaluate the security posture of azure or microsoft 365 environments. if this is expected behavior, consider adjusting the rule or adding exceptions for specific ip addresses, registered applications, jwt tokens, prts or user
false positives depend on scripts and administrative tools used in the monitored environment
first-time use of a legitimate first-party or sanctioned client by the user (newly installed app, first sign-in to a workload, fresh powershell module install). validate by `azure.aadgraphactivitylogs.properties.app_id` and the user's history.
go utilities that use staaldraad awesome ntlm library
if source account name is not an admin then its super suspicious
inventory tool runs
legacy tooling may still be using aad graph. validate and add exceptions on the calling app id after review.
legitimate admin activity
legitimate administration activities
legitimate administrative or security assessment activities may use these user-agents, especially in environments where teamfiltration is employed for authorized audits. if this is expected behavior, consider adjusting the rule or adding exceptions for specific user-agents or ip addresses.
legitimate administrator or user enumerates local users for legitimate reason
legitimate first-party clients occasionally hit 4xx responses as part of conditional access flows, transient permission changes, or stale token retries. tune the threshold for your tenant baseline.
legitimate first-party microsoft components (for example the azure graph client library used by portal or office experiences) occasionally call aad graph with the internal api version, but at single-digit to low-double-digit volume; the burst thresholds exclude them. validate the calling `azure.aadgraphactivitylogs.properties.app_id` and user if a low-volume match appears.
legitimate first-party or line-of-business applications that use delegated permissions and enumerate several graph resources during onboarding or sync may match. baseline known app ids and tune thresholds or path lists for your tenant.
legitimate internal security scanning or key validation that intentionally uses trufflehog. authorize and filter known scanner roles, ip ranges, or assumed roles as needed.
legitimate powershell scripts that make use of these functions.
legitimate usage of the utility by administrators to query the event log
legitimate use of adexplorer by administrators creating .dat snapshots
legitimate use of psloglist by an administrator
new ec2 workloads, nat or egress changes, isp renumbering, or geoip database updates can change `source.as.organization.name` for the same logical path. roles that legitimately call sts from many networks (for example, developer-exported temporary credentials) may also produce alerts. tune using role arn, account, or user agent where appropriate.
organization administrators, identity teams, and compliance reviewers may list users, export members, and view groups during audits, access reviews, or offboarding. confirm the actor and change ticket before escalating.
organization and security administrators, billing tooling, landing-zone automation, and delegated administrator workflows may call these apis legitimately. interactive or one-off use from unusual principals warrants review.
other programs that use these command line option and accepts an 'all' parameter
powershell and windows command shell are often observed as legit child processes of the jetbrains teamcity service and may require further tuning.
some false positives may arise in some environment and this may require some tuning. add additional filters or reduce level depending on the level of noise
there is a potential for false positives if the direct interactive kubernetes api requests are used for legitimate purposes, such as debugging or troubleshooting. it is important to investigate any alerts generated by this rule to determine if they are indicative of malicious activity or part of legitimate container activity.
there is a risk of false positives if there are several containers named the same, as the rule may correlate the request to the wrong container.
unknown
unlikely
verify whether the user identity should be using the sts getcalleridentity api. if known behavior is causing false positives, it can be exempted from the rule.