Detection: Azure AD User Consent Blocked for Risky Application

Description

The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. This detection leverages Azure AD audit logs, focusing on user consent actions and system-driven blocks. Monitoring these blocked consent attempts is crucial as it highlights potential threats early on, indicating that a user might be targeted or that malicious applications are attempting to infiltrate the organization. If confirmed malicious, this activity suggests that Azure's security measures successfully prevented a harmful application from accessing organizational data, warranting immediate investigation to understand the context and take preventive measures.

Search

 1`azure_monitor_aad` operationName="Consent to application" properties.result=failure 
 2| rename properties.* as *  
 3| eval reason_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Reason"), -1) 
 4| eval permissions_index = if(mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions") >= 0, mvfind('targetResources{}.modifiedProperties{}.displayName', "ConsentAction.Permissions"), -1) 
 5| search reason_index >= 0  
 6| eval reason = mvindex('targetResources{}.modifiedProperties{}.newValue',reason_index) 
 7| eval permissions = mvindex('targetResources{}.modifiedProperties{}.newValue',permissions_index) 
 8| search reason = "\"Risky application detected\"" 
 9| rex field=permissions "Scope: (?<Scope>[^,]+)" 
10| stats count min(_time) as firstTime max(_time) as lastTime by operationName, user, reason, Scope 
11| `security_content_ctime(firstTime)` 
12| `security_content_ctime(lastTime)` 
13| `azure_ad_user_consent_blocked_for_risky_application_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
Azure Active Directory Consent to application	Azure	'azure:monitor:aad'	'Azure AD'	N/A

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category.

Known False Positives

UPDATE_KNOWN_FALSE_POSITIVES

Associated Analytic Story

• Azure Active Directory Account Takeover

Risk Based Analytics (RBA)

References

• https://attack.mitre.org/techniques/T1528/

• https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/

• https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing

• https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth

• https://www.alteredsecurity.com/post/introduction-to-365-stealer

• https://github.com/AlteredSecurity/365-Stealer

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 2