O365 Admin Consent Bypassed by Service Principal

Name:O365 Admin Consent Bypassed by Service Principal
id:8a1b22eb-50ce-4e26-a691-97ff52349569
version:3
date:2024-09-30
author:Mauricio Velazco, Splunk
status:production
type:TTP
Description:The following analytic identifies instances where a service principal in Office 365 Azure Active Directory assigns app roles without standard admin consent. It leverages `o365_management_activity` logs, specifically focusing on the 'Add app role assignment to service principal' operation. This activity is significant for SOCs as it may indicate a bypass of critical administrative controls, potentially leading to unauthorized access or privilege escalation. If confirmed malicious, this could allow an attacker to misuse automated processes to assign sensitive permissions, compromising the security of the environment.
Data_source:

• -O365 Add app role assignment to service principal.

search:`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment to service principal."
| eval len=mvcount('Actor{}.ID')
| eval userType = mvindex('Actor{}.ID',len-1)
| eval roleId = mvindex('ModifiedProperties{}.NewValue', 0)
| eval roleValue = mvindex('ModifiedProperties{}.NewValue', 1)
| eval roleDescription = mvindex('ModifiedProperties{}.NewValue', 2)
| eval dest_user = mvindex('Target{}.ID', 0)
| search userType = "ServicePrincipal"
| eval src_user = user
| stats count earliest(_time) as firstTime latest(_time) as lastTime by src_user dest_user roleId roleValue roleDescription
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `o365_admin_consent_bypassed_by_service_principal_filter`

how_to_implement:You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives:Service Principals are sometimes configured to legitimately bypass the consent process for purposes of automation. Filter as needed.
References:
  -https://attack.mitre.org/techniques/T1098/003/
  -https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
  -https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
  -https://attack.mitre.org/techniques/T1098/002/
  -https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
  -https://winsmarts.com/how-to-grant-admin-consent-to-an-api-programmatically-e32f4a100e9d
drilldown_searches:
 name:'View the detection results for - "$dest_user$"'
 search:'%original_detection_search% | search dest_user = "$dest_user$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$dest_user$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest_user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
tags:
  analytic_story:
    - 'Office 365 Persistence Mechanisms'
  asset_type:O365 Tenant
  confidence:60
  impact:90
  message:Service principal $src_user$ bypassed the admin consent process and granted permissions to $dest_user$
  mitre_attack_id:
    - 'T1098.003'
  observable:
    name:'dest_user'
    type:'User'
    - role:
      - 'Victim'
  product:
    - 'Splunk Enterprise'
    - 'Splunk Enterprise Security'
    - 'Splunk Cloud'
  required_fields:
    - '_time'
    - 'Workload'
    - 'Operation'
    - 'Actor{}.ID'
    - 'ModifiedProperties{}.NewValue'
    - 'src_user'
    - 'dest_user'
  risk_score:54
  security_domain:identity

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/o365_bypass_admin_consent/o365_bypass_admin_consent.log
  source: o365
  sourcetype: o365:management:activity
manual_test:None