Azure DevOps PAT used with Browser

Back


Id	5f0d80db-3415-4265-9d52-8466b7372e3a
Rulename	Azure DevOps PAT used with Browser
Description	Personal Access Tokens (PATs) are used as an alternate password to authenticate into Azure DevOps. PATs are intended for programmatic access use in code or applications. This can be prone to attacker theft if not adequately secured. This query looks for the use of a PAT in authentication but from a User Agent indicating a browser. This should not be normal activity and could be an indicator of an attacker using a stolen PAT.
Severity	Medium
Tactics	CredentialAccess
Techniques	T1528
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml
Version	1.0.6
Arm template	5f0d80db-3415-4265-9d52-8466b7372e3a.json

KQL

ADOAuditLogs
| where AuthenticationMechanism startswith "PAT"
// Look for useragents that include a redenring engine
| where UserAgent has_any ("Gecko", "WebKit", "Presto", "Trident", "EdgeHTML", "Blink")
| extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorUPN
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: AccountUPNSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IpAddress
tactics:
- CredentialAccess
requiredDataConnectors: []
id: 5f0d80db-3415-4265-9d52-8466b7372e3a
severity: Medium
status: Available
query: |
  ADOAuditLogs
  | where AuthenticationMechanism startswith "PAT"
  // Look for useragents that include a redenring engine
  | where UserAgent has_any ("Gecko", "WebKit", "Presto", "Trident", "EdgeHTML", "Blink")
  | extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml
kind: Scheduled
queryPeriod: 1d
version: 1.0.6
name: Azure DevOps PAT used with Browser
queryFrequency: 1d
triggerThreshold: 0
relevantTechniques:
- T1528
description: |
  'Personal Access Tokens (PATs) are used as an alternate password to authenticate into Azure DevOps. PATs are intended for programmatic access use in code or applications. 
  This can be prone to attacker theft if not adequately secured. This query looks for the use of a PAT in authentication but from a User Agent indicating a browser. 
  This should not be normal activity and could be an indicator of an attacker using a stolen PAT.'  
triggerOperator: gt

ARM