BloodHound Suite User-Agents Detected

  1[metadata]
  2creation_date = "2025/06/03"
  3integration = ["azure", "o365"]
  4maturity = "production"
  5updated_date = "2025/06/03"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies potential enumeration activity using AzureHound, SharpHound, or BloodHound across Microsoft cloud services.
 11These tools are often used by red teamers and adversaries to map users, groups, roles, applications, and access
 12relationships within Microsoft Entra ID (Azure AD) and Microsoft 365.
 13"""
 14false_positives = [
 15    """
 16    Legitimate administrative or security assessment activities may use these user-agents, especially in environments
 17    where BloodHound is employed for authorized audits. If this is expected behavior, consider adjusting the rule or
 18    adding exceptions for specific user-agents or IP addresses.
 19    """,
 20    """
 21    Expected red team assessments or penetration tests may utilize BloodHound tools to evaluate the security posture of
 22    Azure or Microsoft 365 environments. If this is expected behavior, consider adjusting the rule or adding exceptions
 23    for specific IP addresses, registered applications, JWT tokens, PRTs or user principal names (UPNs).
 24    """,
 25]
 26from = "now-9m"
 27index = ["filebeat-*", "logs-azure.*", "logs-o365.audit-*"]
 28language = "eql"
 29license = "Elastic License v2"
 30name = "BloodHound Suite User-Agents Detected"
 31note = """## Triage and analysis
 32
 33This rule identifies potential enumeration activity using AzureHound, SharpHound, or BloodHound across Microsoft cloud services. These tools are often used by red teamers and adversaries to map users, groups, roles, applications, and access relationships within Microsoft Entra ID (Azure AD) and Microsoft 365.
 34
 35The detection is based on known enumeration patterns, particularly the presence of suspicious user agent strings (e.g., `azurehound/`, `sharphound/`, `bloodhound/`) in various Azure and M365 logs. The rule monitors multiple log sources, including:
 36
 37- Azure Graph API Activity Logs
 38- Microsoft 365 Audit Logs
 39- Entra ID Sign-in Logs
 40- Entra ID Audit Logs
 41- Azure Activity Logs
 42
 43This ensures broader detection of credential abuse, token misuse, or unauthorized identity discovery activity from both interactive and non-interactive (API) sessions.
 44
 45### Possible investigation steps
 46
 47- Confirm the tool used via `user_agent.original`. Look for:
 48    - `azurehound/x.y.z`
 49    - `bloodhound/1.0`
 50    - `sharphound/1.0`
 51- Examine `url.original` or `url.path` to determine which APIs were accessed if Graph API activity logs. For example:
 52    - `/v1.0/organization`, `/v1.0/users`, `/v1.0/groups` may indicate user/group/tenant discovery.
 53- Identify the `user.id`, `user.name`, or `azure.auditlogs.properties.initiated_by.user.user_principal_name` fields to determine which identity executed the API request.
 54- Review `app_id`, `app_display_name`, or `client_id` to identify the application context (e.g., Azure CLI, Graph Explorer, unauthorized app).
 55- Check `http.request.method`, `http.response.status_code`, and `event.action` for enumeration patterns (many successful GETs in a short period) if Graph API activity logs.
 56- Investigate correlated sign-ins (`azure.signinlogs`) by the same user, IP, or app immediately preceding the API calls. Was MFA used? Is the location suspicious?
 57- Review `source.ip`, `client.geo.*`, and `network.*` fields to determine the origin of the requests. Flag unexpected IPs or ISPs.
 58- If the event originates in M365 Audit Logs, investigate cross-service activity: Exchange Online, Teams, SharePoint, or role escalations via Unified Audit.
 59
 60### False positive analysis
 61
 62- This activity may be benign if performed by red teams, internal security auditors, or known security tools under authorization.
 63- Automated monitoring solutions, cloud posture scanners, or legitimate Azure/M365 integrations may generate similar traffic. Review the `app_id` and user context.
 64- Developer activity in test tenants may include tool usage for learning or validation purposes.
 65
 66### Response and remediation
 67
 68- If confirmed malicious:
 69    - Revoke active sessions or tokens associated with the identified user/app.
 70    - Disable the account or rotate credentials immediately.
 71    - Review the role assignments (`Directory.Read.All`, `AuditLog.Read.All`, `Directory.AccessAsUser.All`) and remove excessive privileges.
 72    - Conduct historical analysis to determine how long enumeration has been occurring and what objects were queried.
 73    - Enable Conditional Access policies to require MFA for API and CLI-based access.
 74    - Validate audit logging and alerting is enabled across Microsoft Graph, Azure Activity Logs, and M365 workloads.
 75
 76- If legitimate:
 77    - Document the source (e.g., red team operation, security tool).
 78    - Add appropriate allowlist conditions for service principal, user, source address or device if policy allows.
 79
 80"""
 81references = [
 82    "https://specterops.io/bloodhound-overview/",
 83    "https://github.com/SpecterOps/AzureHound",
 84    "https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/",
 85]
 86risk_score = 47
 87rule_id = "c28750fa-4092-11f0-aca6-f661ea17fbcd"
 88severity = "medium"
 89tags = [
 90    "Domain: Cloud",
 91    "Data Source: Azure",
 92    "Data Source: Azure Activity Logs",
 93    "Data Source: Graph API",
 94    "Data Source: Graph API Activity Logs",
 95    "Data Source: Microsoft 365",
 96    "Data Source: Microsoft 365 Audit Logs",
 97    "Data Source: Microsoft Entra ID",
 98    "Data Source: Microsoft Entra ID Audit Logs",
 99    "Data Source: Microsoft Entra ID Sign-in Logs",
100    "Use Case: Identity and Access Audit",
101    "Use Case: Threat Detection",
102    "Tactic: Discovery",
103    "Resources: Investigation Guide",
104]
105timestamp_override = "event.ingested"
106type = "eql"
107
108query = '''
109any where event.dataset : (
110    "azure.activitylogs",
111    "azure.graphactivitylogs",
112    "azure.auditlogs",
113    "azure.signinlogs",
114    "o365.audit"
115) and user_agent.original regex~ "(azure|sharp|blood)(hound)/.*"
116'''
117
118
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121[[rule.threat.technique]]
122id = "T1069"
123name = "Permission Groups Discovery"
124reference = "https://attack.mitre.org/techniques/T1069/"
125[[rule.threat.technique.subtechnique]]
126id = "T1069.003"
127name = "Cloud Groups"
128reference = "https://attack.mitre.org/techniques/T1069/003/"
129
130
131[[rule.threat.technique]]
132id = "T1082"
133name = "System Information Discovery"
134reference = "https://attack.mitre.org/techniques/T1082/"
135
136[[rule.threat.technique]]
137id = "T1087"
138name = "Account Discovery"
139reference = "https://attack.mitre.org/techniques/T1087/"
140[[rule.threat.technique.subtechnique]]
141id = "T1087.004"
142name = "Cloud Account"
143reference = "https://attack.mitre.org/techniques/T1087/004/"
144
145
146[[rule.threat.technique]]
147id = "T1201"
148name = "Password Policy Discovery"
149reference = "https://attack.mitre.org/techniques/T1201/"
150
151[[rule.threat.technique]]
152id = "T1526"
153name = "Cloud Service Discovery"
154reference = "https://attack.mitre.org/techniques/T1526/"
155
156[[rule.threat.technique]]
157id = "T1580"
158name = "Cloud Infrastructure Discovery"
159reference = "https://attack.mitre.org/techniques/T1580/"
160
161[[rule.threat.technique]]
162id = "T1673"
163name = "Virtual Machine Discovery"
164reference = "https://attack.mitre.org/techniques/T1673/"
165
166
167[rule.threat.tactic]
168id = "TA0007"
169name = "Discovery"
170reference = "https://attack.mitre.org/tactics/TA0007/"