Conditional Access - A Conditional Access Device platforms condition has changed the Device platforms condition can be spoofed

Back


Id	e3368079-a2c0-4f1c-9fb7-287e907393ef
Rulename	Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)
Description	A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1562.007
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).yaml
Version	1.0.1
Arm template	e3368079-a2c0-4f1c-9fb7-287e907393ef.json

KQL

// A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).
AuditLogs
| where OperationName in ("Update conditional access policy")
| extend excludePlatformsOld = extractjson("$.conditions.platforms.excludePlatforms", tostring(TargetResources[0].modifiedProperties[0].oldValue))
| extend excludePlatformsNew = extractjson("$.conditions.platforms.excludePlatforms", tostring(TargetResources[0].modifiedProperties[0].newValue))
| where excludePlatformsOld != excludePlatformsNew
| extend modifiedBy = tostring(InitiatedBy.user.userPrincipalName)
| extend accountName = tostring(split(modifiedBy, "@")[0])
| extend upnSuffix = tostring(split(modifiedBy, "@")[1])
| project
    TimeGenerated,
    OperationName,
    policy = TargetResources[0].displayName,
    modifiedBy,
    accountName,
    upnSuffix,
    result = Result,
    excludePlatformsOld,
    excludePlatformsNew
| order by TimeGenerated desc

YAML

id: e3368079-a2c0-4f1c-9fb7-287e907393ef
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).yaml
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: accountName
  - identifier: UPNSuffix
    columnName: upnSuffix
  entityType: Account
requiredDataConnectors:
- dataTypes:
  - AuditLogs
  connectorId: AzureActiveDirectory
queryFrequency: 5m
suppressionEnabled: false
queryPeriod: 5m
triggerThreshold: 0
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT1H
    groupByAlertDetails: []
    reopenClosedIncident: false
    matchingMethod: AllEntities
    groupByCustomDetails: []
    groupByEntities: []
    enabled: false
  createIncident: true
query: |
  // A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).
  AuditLogs
  | where OperationName in ("Update conditional access policy")
  | extend excludePlatformsOld = extractjson("$.conditions.platforms.excludePlatforms", tostring(TargetResources[0].modifiedProperties[0].oldValue))
  | extend excludePlatformsNew = extractjson("$.conditions.platforms.excludePlatforms", tostring(TargetResources[0].modifiedProperties[0].newValue))
  | where excludePlatformsOld != excludePlatformsNew
  | extend modifiedBy = tostring(InitiatedBy.user.userPrincipalName)
  | extend accountName = tostring(split(modifiedBy, "@")[0])
  | extend upnSuffix = tostring(split(modifiedBy, "@")[1])
  | project
      TimeGenerated,
      OperationName,
      policy = TargetResources[0].displayName,
      modifiedBy,
      accountName,
      upnSuffix,
      result = Result,
      excludePlatformsOld,
      excludePlatformsNew
  | order by TimeGenerated desc  
name: Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)
kind: Scheduled
tactics:
- DefenseEvasion
severity: Low
relevantTechniques:
- T1562.007
suppressionDuration: 5h
version: 1.0.1
description: A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID.

ARM