Azure DevOps Personal Access Token PAT misuse

Back


Id	ac891683-53c3-4f86-86b4-c361708e2b2b
Rulename	Azure DevOps Personal Access Token (PAT) misuse
Description	This Alert detects whenever a PAT is used in ways that PATs are not normally used. May require an allow list and baselining. Reference - https://docs.microsoft.com/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page Use this query for baselining: ADOAuditLogs \| distinct OperationName
Severity	High
Tactics	Execution Impact
Techniques	T1496 T1559
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOPatSessionMisuse.yaml
Version	1.0.6
Arm template	ac891683-53c3-4f86-86b4-c361708e2b2b.json

KQL

// Allowlisted UPNs should likely stay empty
let AllowlistedUpns = datatable(UPN:string)['foo@bar.com', 'test@foo.com'];
// Operation Name parts that will alert
let HasAnyBlocklist = datatable(OperationNamePart:string)['Security.','Project.','AuditLog.','Extension.'];
// Distinct Operation Names that will flag
let HasExactBlocklist = datatable(OperationName:string)['Group.UpdateGroupMembership.Add','Library.ServiceConnectionExecuted','Pipelines.PipelineModified',
'Release.ReleasePipelineModified', 'Git.RefUpdatePoliciesBypassed'];
ADOAuditLogs
| where AuthenticationMechanism startswith "PAT" and (OperationName has_any (HasAnyBlocklist) or OperationName in (HasExactBlocklist))
  and ActorUPN !in (AllowlistedUpns)
| project TimeGenerated, AuthenticationMechanism, ProjectName, ActorUPN, ActorDisplayName, IpAddress, UserAgent, OperationName, Details, Data
| extend timestamp = TimeGenerated
| extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])

YAML

entityMappings:
- fieldMappings:
  - columnName: ActorUPN
    identifier: FullName
  - columnName: AccountName
    identifier: Name
  - columnName: AccountUPNSuffix
    identifier: UPNSuffix
  entityType: Account
- fieldMappings:
  - columnName: IpAddress
    identifier: Address
  entityType: IP
severity: High
name: Azure DevOps Personal Access Token (PAT) misuse
triggerThreshold: 0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureDevOpsAuditing/Analytic Rules/AzDOPatSessionMisuse.yaml
id: ac891683-53c3-4f86-86b4-c361708e2b2b
kind: Scheduled
status: Available
queryFrequency: 1h
relevantTechniques:
- T1496
- T1559
description: |
  'This Alert detects whenever a PAT is used in ways that PATs are not normally used. May require an allow list and baselining.
  Reference - https://docs.microsoft.com/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops&tabs=preview-page
  Use this query for baselining:
  ADOAuditLogs
  | distinct OperationName'  
query: |
  // Allowlisted UPNs should likely stay empty
  let AllowlistedUpns = datatable(UPN:string)['foo@bar.com', 'test@foo.com'];
  // Operation Name parts that will alert
  let HasAnyBlocklist = datatable(OperationNamePart:string)['Security.','Project.','AuditLog.','Extension.'];
  // Distinct Operation Names that will flag
  let HasExactBlocklist = datatable(OperationName:string)['Group.UpdateGroupMembership.Add','Library.ServiceConnectionExecuted','Pipelines.PipelineModified',
  'Release.ReleasePipelineModified', 'Git.RefUpdatePoliciesBypassed'];
  ADOAuditLogs
  | where AuthenticationMechanism startswith "PAT" and (OperationName has_any (HasAnyBlocklist) or OperationName in (HasExactBlocklist))
    and ActorUPN !in (AllowlistedUpns)
  | project TimeGenerated, AuthenticationMechanism, ProjectName, ActorUPN, ActorDisplayName, IpAddress, UserAgent, OperationName, Details, Data
  | extend timestamp = TimeGenerated
  | extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])  
version: 1.0.6
tactics:
- Execution
- Impact
queryPeriod: 1h
requiredDataConnectors: []

ARM