Azure External Guest User Invitation

 1[metadata]
 2creation_date = "2020/08/31"
 3integration = ["azure"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include
11collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account.
12Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users
13could potentially be overlooked indefinitely leading to a potential vulnerability.
14"""
15false_positives = [
16    """
17    Guest user invitations may be sent out by a system or network administrator. Verify whether the username, hostname,
18    and/or resource name should be making changes in your environment. Guest user invitations from unfamiliar users or
19    hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
20    """,
21]
22from = "now-25m"
23index = ["filebeat-*", "logs-azure*"]
24language = "kuery"
25license = "Elastic License v2"
26name = "Azure External Guest User Invitation"
27note = """## Setup
28
29The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
30references = ["https://docs.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-1-0"]
31risk_score = 21
32rule_id = "141e9b3a-ff37-4756-989d-05d7cbf35b0e"
33severity = "low"
34tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Identity and Access Audit", "Tactic: Initial Access"]
35timestamp_override = "event.ingested"
36type = "query"
37
38query = '''
39event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Invite external user" and azure.auditlogs.properties.target_resources.*.display_name:guest and event.outcome:(Success or success)
40'''
41
42
43[[rule.threat]]
44framework = "MITRE ATT&CK"
45[[rule.threat.technique]]
46id = "T1078"
47name = "Valid Accounts"
48reference = "https://attack.mitre.org/techniques/T1078/"
49
50
51[rule.threat.tactic]
52id = "TA0001"
53name = "Initial Access"
54reference = "https://attack.mitre.org/tactics/TA0001/"
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57[[rule.threat.technique]]
58id = "T1078"
59name = "Valid Accounts"
60reference = "https://attack.mitre.org/techniques/T1078/"
61
62
63[rule.threat.tactic]
64id = "TA0003"
65name = "Persistence"
66reference = "https://attack.mitre.org/tactics/TA0003/"