Azure External Guest User Invitation

 1[metadata]
 2creation_date = "2020/08/31"
 3integration = ["azure"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include
13collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account.
14Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users
15could potentially be overlooked indefinitely leading to a potential vulnerability.
16"""
17false_positives = [
18    """
19    Guest user invitations may be sent out by a system or network administrator. Verify whether the username, hostname,
20    and/or resource name should be making changes in your environment. Guest user invitations from unfamiliar users or
21    hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
22    """,
23]
24from = "now-25m"
25index = ["filebeat-*", "logs-azure*"]
26language = "kuery"
27license = "Elastic License v2"
28name = "Azure External Guest User Invitation"
29note = """## Setup
30
31The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
32references = ["https://docs.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-1-0"]
33risk_score = 21
34rule_id = "141e9b3a-ff37-4756-989d-05d7cbf35b0e"
35severity = "low"
36tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Identity and Access Audit", "Tactic: Initial Access"]
37timestamp_override = "event.ingested"
38type = "query"
39
40query = '''
41event.dataset:azure.auditlogs and azure.auditlogs.operation_name:"Invite external user" and azure.auditlogs.properties.target_resources.*.display_name:guest and event.outcome:(Success or success)
42'''
43
44
45[[rule.threat]]
46framework = "MITRE ATT&CK"
47[[rule.threat.technique]]
48id = "T1078"
49name = "Valid Accounts"
50reference = "https://attack.mitre.org/techniques/T1078/"
51
52
53[rule.threat.tactic]
54id = "TA0001"
55name = "Initial Access"
56reference = "https://attack.mitre.org/tactics/TA0001/"
57[[rule.threat]]
58framework = "MITRE ATT&CK"
59[[rule.threat.technique]]
60id = "T1078"
61name = "Valid Accounts"
62reference = "https://attack.mitre.org/techniques/T1078/"
63
64
65[rule.threat.tactic]
66id = "TA0003"
67name = "Persistence"
68reference = "https://attack.mitre.org/tactics/TA0003/"