Sample rules
Azure AD Block User Consent For Risky Apps Disabled
- source: splunk
- technicques:
- T1562
Description
This analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. This setting, when enabled, prevents regular users from granting consent to potentially malicious OAuth applications, requiring an administrative step-up for consent instead. Disabling this feature could expose the organization to OAuth phishing threats.The detection operates by monitoring Azure Active Directory logs for events where the “Update authorization policy” operation is performed. It specifically looks for changes to the “AllowUserConsentForRiskyApps” setting, identifying instances where this setting is switched to “true,” effectively disabling the risk-based step-up consent. Monitoring for changes to critical security settings like the “risk-based step-up consent” is vital for maintaining the integrity of an organization’s security posture. Disabling this feature can make the environment more susceptible to OAuth phishing attacks, where attackers trick users into granting permissions to malicious applications. Identifying when this setting is disabled can help blue teams to quickly respond, investigate, and potentially uncover targeted phishing campaigns against their users. If an attacker successfully disables the “risk-based step-up consent” and subsequently launches an OAuth phishing campaign, they could gain unauthorized access to user data and other sensitive information within the M365 environment. This could lead to data breaches, unauthorized access to emails, and potentially further compromise within the organization
Detection logic
`azure_monitor_aad` operationName="Update authorization policy"
| rename properties.* as *
| eval index_number = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "AllowUserConsentForRiskyApps") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "AllowUserConsentForRiskyApps"), -1)
| search index_number >= 0
| eval AllowUserConsentForRiskyApps = mvindex('targetResources{}.modifiedProperties{}.newValue',index_number)
| search AllowUserConsentForRiskyApps = "[true]"
| stats count min(_time) as firstTime max(_time) as lastTime by user, src_ip, operationName, AllowUserConsentForRiskyApps
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `azure_ad_block_user_consent_for_risky_apps_disabled_filter`
O365 Block User Consent For Risky Apps Disabled
- source: splunk
- technicques:
- T1562
Description
This analytic detects when the “risk-based step-up consent” security setting in Microsoft 365 is disabled. This setting, when enabled, prevents regular users from granting consent to potentially malicious OAuth applications, requiring an administrative “step-up” for consent instead. Disabling this feature could expose the organization to OAuth phishing threats.The detection operates by monitoring Azure Active Directory logs for events where the “Update authorization policy” operation is performed. It specifically looks for changes to the “AllowUserConsentForRiskyApps” setting, identifying instances where this setting is switched to “true,” effectively disabling the risk-based step-up consent. Monitoring for changes to critical security settings like the “risk-based step-up consent” is vital for maintaining the integrity of an organization’s security posture. Disabling this feature can make the environment more susceptible to OAuth phishing attacks, where attackers trick users into granting permissions to malicious applications. Identifying when this setting is disabled can help blue teams to quickly respond, investigate, and potentially uncover targeted phishing campaigns against their users. If an attacker successfully disables the “risk-based step-up consent” and subsequently launches an OAuth phishing campaign, they could gain unauthorized access to user data and other sensitive information within the M365 environment. This could lead to data breaches, unauthorized access to emails, and potentially further compromise within the organization.
Detection logic
`o365_management_activity` Workload=AzureActiveDirectory Operation="Update authorization policy."
| eval index_number = if(mvfind('ModifiedProperties{}.Name', "AllowUserConsentForRiskyApps") >= 0, mvfind('ModifiedProperties{}.Name', "AllowUserConsentForRiskyApps"), -1)
| search index_number >= 0
| eval AllowUserConsentForRiskyApps = mvindex('ModifiedProperties{}.NewValue',index_number)
| where AllowUserConsentForRiskyApps like "%true%"
| stats count min(_time) as firstTime max(_time) as lastTime by user, Operation, AllowUserConsentForRiskyApps, user_agent
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_block_user_consent_for_risky_apps_disabled_filter`