ContraForce - Machine credential activity | Microsoft Sentinel Analytic Rules

Back


Id	8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52
Rulename	ContraForce - Machine credential activity
Description	Identifies service-account and machine-credential lifecycle activity in the ContraForce workspace: service accounts created or deleted, credentials created, regenerated or revoked, and API client secret regenerations. Machine credentials grant standing programmatic access, so unexpected lifecycle events can indicate persistence being established or an attempt to rotate credentials out from under their legitimate owner.
Severity	Medium
Tactics	Persistence CredentialAccess
Techniques	T1098 T1136
Required data connectors	ContraForceEvents
Kind	Scheduled
Query frequency	5m
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContraForce/Analytic%20Rules/ContraForceMachineCredentialActivity.yaml
Version	1.0.0
Arm template	8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52.json

KQL

ContraForceEvents_CL
| where ingestion_time() > ago(5m)
| where ActivityType in ("ServiceAccountCreated", "ServiceAccountDeleted", "ServiceAccountCredentialCreated", "ServiceAccountCredentialRegenerated", "ServiceAccountCredentialRevoked", "ApiClientSecretRegenerated")
| extend Meta = parse_json(Metadata)
| project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,
          ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName, Metadata

YAML

tactics:
- Persistence
- CredentialAccess
name: ContraForce - Machine credential activity
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContraForce/Analytic%20Rules/ContraForceMachineCredentialActivity.yaml
version: 1.0.0
queryFrequency: 5m
requiredDataConnectors:
- connectorId: ContraForceEvents
  dataTypes:
  - ContraForceEvents_CL
customDetails:
  EventId: EventId
  CfWorkspaceId: CfWorkspaceId
  ActorEmail: ActorEmail
  TargetResourceId: TargetResourceId
id: 8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52
triggerThreshold: 0
queryPeriod: 1d
alertDetailsOverride:
  alertDescriptionFormat: '{{ActorName}} performed {{ActivityType}} on {{TargetResourceName}}.'
  alertDisplayNameFormat: 'ContraForce machine credential activity: {{ActivityType}} on {{TargetResourceName}}'
severity: Medium
relevantTechniques:
- T1098
- T1136
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |
  'Identifies service-account and machine-credential lifecycle activity in the ContraForce
  workspace: service accounts created or deleted, credentials created, regenerated or revoked,
  and API client secret regenerations. Machine credentials grant standing programmatic access,
  so unexpected lifecycle events can indicate persistence being established or an attempt to
  rotate credentials out from under their legitimate owner.'
triggerOperator: gt
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    groupByCustomDetails:
    - EventId
    matchingMethod: Selected
    lookbackDuration: PT2H
    reopenClosedIncident: false
kind: Scheduled
query: |
  ContraForceEvents_CL
  | where ingestion_time() > ago(5m)
  | where ActivityType in ("ServiceAccountCreated", "ServiceAccountDeleted", "ServiceAccountCredentialCreated", "ServiceAccountCredentialRegenerated", "ServiceAccountCredentialRevoked", "ApiClientSecretRegenerated")
  | extend Meta = parse_json(Metadata)
  | project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,
            ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName, Metadata

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{ActorName}} performed {{ActivityType}} on {{TargetResourceName}}.",
          "alertDisplayNameFormat": "ContraForce machine credential activity: {{ActivityType}} on {{TargetResourceName}}"
        },
        "alertRuleTemplateName": "8a2c6e94-1b5d-4f7a-b3e8-2c9d4f6a1e52",
        "customDetails": {
          "ActorEmail": "ActorEmail",
          "CfWorkspaceId": "CfWorkspaceId",
          "EventId": "EventId",
          "TargetResourceId": "TargetResourceId"
        },
        "description": "'Identifies service-account and machine-credential lifecycle activity in the ContraForce\nworkspace: service accounts created or deleted, credentials created, regenerated or revoked,\nand API client secret regenerations. Machine credentials grant standing programmatic access,\nso unexpected lifecycle events can indicate persistence being established or an attempt to\nrotate credentials out from under their legitimate owner.'\n",
        "displayName": "ContraForce - Machine credential activity",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "EventId"
            ],
            "lookbackDuration": "PT2H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContraForce/Analytic%20Rules/ContraForceMachineCredentialActivity.yaml",
        "query": "ContraForceEvents_CL\n| where ingestion_time() > ago(5m)\n| where ActivityType in (\"ServiceAccountCreated\", \"ServiceAccountDeleted\", \"ServiceAccountCredentialCreated\", \"ServiceAccountCredentialRegenerated\", \"ServiceAccountCredentialRevoked\", \"ApiClientSecretRegenerated\")\n| extend Meta = parse_json(Metadata)\n| project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,\n          ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName, Metadata\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Persistence"
        ],
        "techniques": [
          "T1098",
          "T1136"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}