Changes to Application Logout URL

Back


Id	492fbe35-cbac-4a8c-9059-826782e6915a
Rulename	Changes to Application Logout URL
Description	Detects changes to an applications sign out URL. Look for any modifications to a sign out URL. Blank entries or entries to non-existent locations would stop a user from terminating a session. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#logout-url-modified-or-removed
Severity	Low
Tactics	Persistence PrivilegeEscalation
Techniques	T1078.004
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ChangestoApplicationLogoutURL.yaml
Version	1.1.1
Arm template	492fbe35-cbac-4a8c-9059-826782e6915a.json

KQL

AuditLogs
  | where Category =~ "ApplicationManagement"
  | where OperationName has_any ("Update Application", "Update Service principal")
  | extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
  | extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
  | extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
  | extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
  | extend InitiatingIPAddress = tostring(InitiatedBy.user.ipAddress)
  | extend TargetAppName = tostring(TargetResources[0].displayName)
  | extend mod_props = TargetResources[0].modifiedProperties
  | mv-expand mod_props
  | extend Action = tostring(mod_props.displayName)
  | where Action contains "Url"
  | extend UpdatedBy = iif(isnotempty(InitiatingAppName), InitiatingAppName, InitiatingUserPrincipalName)
  | extend OldURL = tostring(mod_props.oldValue)
  | extend NewURL = tostring(mod_props.newValue)
  | extend InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, "@")[0]), InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, "@")[1])
  | project-reorder TimeGenerated, InitiatingAppName, InitiatingAppServicePrincipalId, InitiatingAadUserId, InitiatingUserPrincipalName, InitiatingIPAddress, UpdatedBy

YAML

version: 1.1.1
id: 492fbe35-cbac-4a8c-9059-826782e6915a
triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: InitiatingUserPrincipalName
    identifier: FullName
  - columnName: InitiatingAccountName
    identifier: Name
  - columnName: InitiatingAccountUPNSuffix
    identifier: UPNSuffix
- entityType: Account
  fieldMappings:
  - columnName: InitiatingAadUserId
    identifier: AadUserId
- entityType: URL
  fieldMappings:
  - columnName: OldURL
    identifier: Url
- entityType: URL
  fieldMappings:
  - columnName: NewURL
    identifier: Url
- entityType: IP
  fieldMappings:
  - columnName: InitiatingIPAddress
    identifier: Address
queryPeriod: 1d
name: Changes to Application Logout URL
metadata:
  author:
    name: Microsoft Security Research
  source:
    kind: Community
  categories:
    domains:
    - Security - Others
  support:
    tier: Community
queryFrequency: 1d
requiredDataConnectors:
- dataTypes:
  - AuditLogs
  connectorId: AzureActiveDirectory
severity: Low
relevantTechniques:
- T1078.004
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ChangestoApplicationLogoutURL.yaml
tags:
- AADSecOpsGuide
description: |
  'Detects changes to an applications sign out URL.
    Look for any modifications to a sign out URL. Blank entries or entries to non-existent locations would stop a user from terminating a session.
    Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#logout-url-modified-or-removed'  
kind: Scheduled
query: |
  AuditLogs
    | where Category =~ "ApplicationManagement"
    | where OperationName has_any ("Update Application", "Update Service principal")
    | extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
    | extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
    | extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
    | extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
    | extend InitiatingIPAddress = tostring(InitiatedBy.user.ipAddress)
    | extend TargetAppName = tostring(TargetResources[0].displayName)
    | extend mod_props = TargetResources[0].modifiedProperties
    | mv-expand mod_props
    | extend Action = tostring(mod_props.displayName)
    | where Action contains "Url"
    | extend UpdatedBy = iif(isnotempty(InitiatingAppName), InitiatingAppName, InitiatingUserPrincipalName)
    | extend OldURL = tostring(mod_props.oldValue)
    | extend NewURL = tostring(mod_props.newValue)
    | extend InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, "@")[0]), InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, "@")[1])
    | project-reorder TimeGenerated, InitiatingAppName, InitiatingAppServicePrincipalId, InitiatingAadUserId, InitiatingUserPrincipalName, InitiatingIPAddress, UpdatedBy  
tactics:
- Persistence
- PrivilegeEscalation
triggerOperator: gt

ARM