New Root Certificate Authority Added

Title: New Root Certificate Authority Added
Status: test
Description:Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
References:
  -https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
  -https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
Author: Harjot Shah Singh, '@cyb3rjy0t'
Date: 2024-03-26
modified:None
Tags:

• -'attack.credential-access'
• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.defense-impairment'
• -'attack.t1556'

Logsource:

• product: azure
• service: auditlogs

Detection:
  selection:
    OperationName: 'Set Company Information'
    TargetResources.modifiedProperties.newValue|contains: 'TrustedCAsForPasswordlessAuth'
  condition:selection
Falsepositives:
  -Unknown
Level: medium