Windows LAPS Credential Dump From Entra ID

Title: Windows LAPS Credential Dump From Entra ID
Status: test
Description:Detects when an account dumps the LAPS password from Entra ID.
References:
  -https://twitter.com/NathanMcNulty/status/1785051227568632263
  -https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/
  -https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487
Author: andrewdanis
Date: 2024-06-26
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098.005'

Logsource:

• product: azure
• service: auditlogs

Detection:
  selection:
    category: 'Device'
    activityType|contains: 'Recover device local administrator password'
    additionalDetails.additionalInfo|contains: 'Successfully recovered local credential by device id'
  condition:selection
Falsepositives:
  -Approved activity performed by an Administrator.
Level: high