attack.t1078.004

Bitbucket User Login Failure

Jan 6, 2025 · attack.defense-evasion attack.credential-access attack.t1078.004 attack.t1110 ·

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

AWS SAML Provider Deletion Activity

Dec 19, 2024 · attack.t1078.004 attack.privilege-escalation attack.t1531 ·

Share on:

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Account Disabled or Blocked for Sign in Attempts

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detects when an account is disabled or blocked for sign in but tried to log in

Application AppID Uri Configuration Changes

Aug 12, 2024 · attack.persistence attack.credential-access attack.privilege-escalation attack.t1552 attack.t1078.004 ·

Share on:

Detects when a configuration change is made to an applications AppID URI.

Application URI Configuration Changes

Aug 12, 2024 · attack.t1528 attack.t1078.004 attack.persistence attack.credential-access attack.privilege-escalation ·

Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

AWS IAM S3Browser LoginProfile Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

AWS IAM S3Browser Templated S3 Bucket Policy Creation

Aug 12, 2024 · attack.execution attack.t1059.009 attack.persistence attack.t1078.004 ·

Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

AWS IAM S3Browser User or AccessKey Creation

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

AWS Root Credentials

Aug 12, 2024 · attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects AWS root account usage

Azure AD Only Single Factor Authentication Required

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1556.006 ·

Share on:

Detect when users are authenticating without MFA being required.

Azure Subscription Permission Elevation Via ActivityLogs

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Bitlocker Key Retrieval

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for Bitlocker key retrieval.

Changes To PIM Settings

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1078.004 ·

Share on:

Detects when changes are made to PIM roles

Device Registration or Join Without MFA

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for device registration or join events where MFA was not performed.

Failed Authentications From Countries You Do Not Operate Out Of

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detect failed authentications from countries you do not operate out of.

Github New Secret Created

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1078.004 ·

Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Github Self Hosted Runner Changes Detected

Aug 12, 2024 · attack.impact attack.discovery attack.collection attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Github SSH Certificate Configuration Changed

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

Guest User Invited By Non Approved Inviters

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1078.004 ·

Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Login to Disabled Account

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detect failed attempts to sign in to disabled accounts.

Multifactor Authentication Denied

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Multifactor Authentication Interrupted

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Okta New Admin Console Behaviours

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detects when Okta identifies new activity in the Admin Console.

Password Reset By User Account

Aug 12, 2024 · attack.persistence attack.credential-access attack.t1078.004 ·

Share on:

Detect when a user has reset their password in Azure AD

PIM Approvals And Deny Elevation

Aug 12, 2024 · attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Potential MFA Bypass Using Legacy Client Authentication

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Privileged Account Creation

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects when a new admin is created.

Sign-in Failure Due to Conditional Access Requirements Not Met

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1110 attack.t1078.004 ·

Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Sign-ins by Unknown Devices

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

Sign-ins from Non-Compliant Devices

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for sign-ins where the device was non-compliant.

Successful Authentications From Countries You Do Not Operate Out Of

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detect successful authentications from countries you do not operate out of.

Temporary Access Pass Added To An Account

Aug 12, 2024 · attack.persistence attack.t1078.004 ·

Share on:

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Use of Legacy Authentication Protocols

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Alert on when legacy authentication has been used on an account

User Access Blocked by Azure Conditional Access

Aug 12, 2024 · attack.credential-access attack.initial-access attack.t1110 attack.t1078.004 ·

Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.