Conditional Access - A Conditional Access Device platforms condition has changed the Device platforms condition can be spoofed

Back


Id	e3368079-a2c0-4f1c-9fb7-287e907393ef
Rulename	Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)
Description	A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID.
Severity	Low
Tactics	DefenseEvasion
Techniques	T1562.007
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).yaml
Version	1.0.1
Arm template	e3368079-a2c0-4f1c-9fb7-287e907393ef.json

KQL

// A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).
AuditLogs
| where OperationName in ("Update conditional access policy")
| extend excludePlatformsOld = extractjson("$.conditions.platforms.excludePlatforms", tostring(TargetResources[0].modifiedProperties[0].oldValue))
| extend excludePlatformsNew = extractjson("$.conditions.platforms.excludePlatforms", tostring(TargetResources[0].modifiedProperties[0].newValue))
| where excludePlatformsOld != excludePlatformsNew
| extend modifiedBy = tostring(InitiatedBy.user.userPrincipalName)
| extend accountName = tostring(split(modifiedBy, "@")[0])
| extend upnSuffix = tostring(split(modifiedBy, "@")[1])
| project
    TimeGenerated,
    OperationName,
    policy = TargetResources[0].displayName,
    modifiedBy,
    accountName,
    upnSuffix,
    result = Result,
    excludePlatformsOld,
    excludePlatformsNew
| order by TimeGenerated desc

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).yaml
suppressionEnabled: false
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: PT1H
    groupByCustomDetails: []
    groupByEntities: []
    enabled: false
    groupByAlertDetails: []
  createIncident: true
suppressionDuration: 5h
queryPeriod: 5m
name: Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- fieldMappings:
  - columnName: accountName
    identifier: Name
  - columnName: upnSuffix
    identifier: UPNSuffix
  entityType: Account
version: 1.0.1
description: A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID.
severity: Low
id: e3368079-a2c0-4f1c-9fb7-287e907393ef
tactics:
- DefenseEvasion
requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - AuditLogs
queryFrequency: 5m
triggerThreshold: 0
query: |
  // A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed).
  AuditLogs
  | where OperationName in ("Update conditional access policy")
  | extend excludePlatformsOld = extractjson("$.conditions.platforms.excludePlatforms", tostring(TargetResources[0].modifiedProperties[0].oldValue))
  | extend excludePlatformsNew = extractjson("$.conditions.platforms.excludePlatforms", tostring(TargetResources[0].modifiedProperties[0].newValue))
  | where excludePlatformsOld != excludePlatformsNew
  | extend modifiedBy = tostring(InitiatedBy.user.userPrincipalName)
  | extend accountName = tostring(split(modifiedBy, "@")[0])
  | extend upnSuffix = tostring(split(modifiedBy, "@")[1])
  | project
      TimeGenerated,
      OperationName,
      policy = TargetResources[0].displayName,
      modifiedBy,
      accountName,
      upnSuffix,
      result = Result,
      excludePlatformsOld,
      excludePlatformsNew
  | order by TimeGenerated desc  
relevantTechniques:
- T1562.007
kind: Scheduled
triggerOperator: gt

ARM