Use Case: Identity and Access Audit

Azure Blob Permissions Modification

Sep 5, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Defense Evasion Data Source: Elastic Defend ·

Share on:

Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An adversary may modify the permissions on a blob to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss.

Rare User Logon

Aug 22, 2023 · Use Case: Identity and Access Audit Use Case: Threat Detection Rule Type: ML Rule Type: Machine Learning Tactic: Initial Access Resources: Investigation Guide ·

Share on:

A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application.

Spike in Failed Logon Events

Aug 22, 2023 · Use Case: Identity and Access Audit Use Case: Threat Detection Rule Type: ML Rule Type: Machine Learning Tactic: Credential Access Resources: Investigation Guide ·

Share on:

A machine learning job found an unusually large spike in authentication failure events. This can be due to password spraying, user enumeration or brute force activity and may be a precursor to account takeover or credentialed access.

Spike in Logon Events

Aug 22, 2023 · Use Case: Identity and Access Audit Use Case: Threat Detection Rule Type: ML Rule Type: Machine Learning Tactic: Credential Access ·

Share on:

A machine learning job found an unusually large spike in successful authentication events. This can be due to password spraying, user enumeration or brute force activity.

Spike in Successful Logon Events from a Source IP

Aug 22, 2023 · Use Case: Identity and Access Audit Use Case: Threat Detection Rule Type: ML Rule Type: Machine Learning Tactic: Credential Access Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity.

Unusual Hour for a User to Logon

Aug 22, 2023 · Use Case: Identity and Access Audit Use Case: Threat Detection Rule Type: ML Rule Type: Machine Learning Tactic: Initial Access Resources: Investigation Guide ·

Share on:

A machine learning job detected a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. In addition, unauthorized user activity often takes place during non-business hours.

Unusual Login Activity

Aug 22, 2023 · Use Case: Identity and Access Audit Use Case: Threat Detection Rule Type: ML Rule Type: Machine Learning Tactic: Credential Access ·

Share on:

Identifies an unusually high number of authentication attempts.

Unusual Source IP for a User to Logon from

Aug 22, 2023 · Use Case: Identity and Access Audit Use Case: Threat Detection Rule Type: ML Rule Type: Machine Learning Tactic: Initial Access ·

Share on:

A machine learning job detected a user logging in from an IP address that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different locations. An unusual source IP address for a username could also be due to lateral movement when a compromised account is used to pivot between hosts.

Attempt to Deactivate an Okta Policy Rule

Aug 21, 2023 · Use Case: Identity and Access Audit Tactic: Defense Evasion Data Source: Okta ·

Share on:

Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an Okta policy in order to remove or weaken an organization's security controls.

Attempt to Deactivate MFA for an Okta User Account

Aug 21, 2023 · Tactic: Persistence Use Case: Identity and Access Audit Data Source: Okta ·

Share on:

Detects attempts to deactivate multi-factor authentication (MFA) for an Okta user. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account.

Attempt to Modify an Okta Policy Rule

Aug 21, 2023 · Use Case: Identity and Access Audit Tactic: Defense Evasion Data Source: Okta ·

Share on:

Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls.

Attempt to Reset MFA Factors for an Okta User Account

Aug 21, 2023 · Tactic: Persistence Use Case: Identity and Access Audit Data Source: Okta ·

Share on:

Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment.

Attempted Bypass of Okta MFA

Aug 21, 2023 · Data Source: Okta Use Case: Identity and Access Audit Tactic: Credential Access ·

Share on:

Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application.

Attempts to Brute Force an Okta User Account

Aug 21, 2023 · Use Case: Identity and Access Audit Tactic: Credential Access Data Source: Okta ·

Share on:

Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts.

High Number of Okta User Password Reset or Unlock Attempts

Aug 21, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Defense Evasion ·

Share on:

Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection.

Modification or Removal of an Okta Application Sign-On Policy

Aug 21, 2023 · Tactic: Persistence Use Case: Identity and Access Audit Data Source: Okta ·

Share on:

Detects attempts to modify or delete a sign on policy for an Okta application. An adversary may attempt to modify or delete the sign on policy for an Okta application in order to remove or weaken an organization's security controls.

Okta Brute Force or Password Spraying Attack

Aug 21, 2023 · Use Case: Identity and Access Audit Tactic: Credential Access Data Source: Okta ·

Share on:

Identifies a high number of failed Okta user authentication attempts from a single IP address, which could be indicative of a brute force or password spraying attack. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts.

Okta User Session Impersonation

Aug 21, 2023 · Use Case: Identity and Access Audit Tactic: Credential Access Data Source: Okta ·

Share on:

A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected.

Potential Abuse of Repeated MFA Push Notifications

Aug 21, 2023 · Use Case: Identity and Access Audit Tactic: Credential Access Data Source: Okta ·

Share on:

Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.

Unauthorized Access to an Okta Application

Aug 21, 2023 · Tactic: Initial Access Use Case: Identity and Access Audit Data Source: Okta ·

Share on:

Identifies unauthorized access attempts to Okta applications.

Attempt to Deactivate an Okta Application

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Impact ·

Share on:

Detects attempts to deactivate an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations.

Attempt to Deactivate an Okta Network Zone

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Use Case: Network Security Monitoring Tactic: Defense Evasion ·

Share on:

Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.

Attempt to Deactivate an Okta Policy

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Defense Evasion ·

Share on:

Detects attempts to deactivate an Okta policy. An adversary may attempt to deactivate an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to deactivate an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts.

Attempt to Delete an Okta Network Zone

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Use Case: Network Security Monitoring Tactic: Defense Evasion ·

Share on:

Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.

Attempt to Delete an Okta Policy

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Defense Evasion ·

Share on:

Detects attempts to delete an Okta policy. An adversary may attempt to delete an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to delete an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts.

Attempt to Delete an Okta Policy Rule

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Defense Evasion ·

Share on:

Detects attempts to delete a rule within an Okta policy. An adversary may attempt to delete an Okta policy rule in order to weaken an organization's security controls.

Attempt to Modify an Okta Network Zone

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Use Case: Network Security Monitoring Tactic: Defense Evasion ·

Share on:

Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.

Attempt to Modify an Okta Policy

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Defense Evasion ·

Share on:

Detects attempts to modify an Okta policy. An adversary may attempt to modify an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to modify an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts.

Attempt to Revoke Okta API Token

Jul 17, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Impact ·

Share on:

Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations.

Administrator Privileges Assigned to an Okta Group

Jun 22, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Persistence ·

Share on:

Detects when an administrator role is assigned to an Okta group. An adversary may attempt to assign administrator privileges to an Okta group in order to assign additional permissions to compromised user accounts and maintain access to their target organization.

Administrator Role Assigned to an Okta User

Jun 22, 2023 · Data Source: Okta Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's environment.

Attempt to Create Okta API Token

Jun 22, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Persistence ·

Share on:

Detects attempts to create an Okta API token. An adversary may create an Okta API token to maintain access to an organization's network while they work to achieve their objectives. An attacker may abuse an API token to execute techniques such as creating user accounts or disabling security rules or policies.

Attempt to Delete an Okta Application

Jun 22, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Impact ·

Share on:

Detects attempts to delete an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations.

Attempt to Modify an Okta Application

Jun 22, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Impact ·

Share on:

Detects attempts to modify an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations.

Attempts to Brute Force a Microsoft 365 User Account

Jun 22, 2023 · Domain: Cloud Data Source: Microsoft 365 Use Case: Identity and Access Audit Tactic: Credential Access ·

Share on:

Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts.

AWS IAM Assume Role Policy Update

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Privilege Escalation ·

Share on:

Identifies attempts to modify an AWS IAM Assume Role Policy. An adversary may attempt to modify the AssumeRolePolicy of a misconfigured role in order to gain the privileges of that role.

AWS IAM Brute Force of Assume Role Policy

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Credential Access ·

Share on:

Identifies a high number of failed attempts to assume an AWS Identity and Access Management (IAM) role. IAM roles are used to delegate access to users or services. An adversary may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role.

AWS IAM Group Creation

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

Identifies the creation of a group in AWS Identity and Access Management (IAM). Groups specify permissions for multiple users. Any user in a group automatically has the permissions that are assigned to the group.

AWS IAM Password Recovery Requested

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Tactic: Initial Access ·

Share on:

Identifies AWS IAM password recovery requests. An adversary may attempt to gain unauthorized AWS access by abusing password recovery mechanisms.

AWS IAM User Addition to Group

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Tactic: Credential Access Tactic: Persistence Resources: Investigation Guide ·

Share on:

Identifies the addition of a user to a specified group in AWS Identity and Access Management (IAM).

AWS Management Console Brute Force of Root User Identity

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Tactic: Credential Access ·

Share on:

Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account.

AWS Management Console Root Login

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Initial Access ·

Share on:

Identifies a successful login to the AWS Management Console by the Root user.

AWS Root Login Without MFA

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Privilege Escalation ·

Share on:

Identifies attempts to login to AWS as the root user without using multi-factor authentication (MFA). Amazon AWS best practices indicate that the root user should be protected by MFA.

AWS SAML Activity

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Tactic: Defense Evasion ·

Share on:

Identifies when SAML activity has occurred in AWS. An adversary could manipulate SAML to maintain access to the target.

AWS Security Token Service (STS) AssumeRole Usage

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Tactic: Privilege Escalation ·

Share on:

Identifies the use of AssumeRole. AssumeRole returns a set of temporary security credentials that can be used to access AWS resources. An adversary could use those credentials to move laterally and escalate privileges.

AWS STS GetSessionToken Abuse

Jun 22, 2023 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Use Case: Identity and Access Audit Tactic: Privilege Escalation ·

Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Azure Active Directory High Risk Sign-in

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Initial Access ·

Share on:

Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised.

Azure Active Directory High Risk User Sign-in Heuristic

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Initial Access ·

Share on:

Identifies high risk Azure Active Directory (AD) sign-ins by leveraging Microsoft Identity Protection machine learning and heuristics.

Azure Active Directory PowerShell Sign-in

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Initial Access ·

Share on:

Identifies a sign-in using the Azure Active Directory PowerShell module. PowerShell for Azure Active Directory allows for managing settings from the command line, which is intended for users who are members of an admin role.

Azure AD Global Administrator Role Assigned

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources.

Azure Application Credential Modification

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Defense Evasion ·

Share on:

Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an environment.

Azure Automation Account Created

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

Identifies when an Azure Automation account is created. Azure Automation accounts can be used to automate management tasks and orchestrate actions across systems. An adversary may create an Automation account in order to maintain persistence in their target's environment.

Azure External Guest User Invitation

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Initial Access ·

Share on:

Identifies an invitation to an external user in Azure Active Directory (AD). Azure AD is extended to include collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account. Unless there is a business need to provision guest access, it is best practice avoid creating guest users. Guest users could potentially be overlooked indefinitely leading to a potential vulnerability.

Azure Global Administrator Role Addition to PIM User

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

Identifies an Azure Active Directory (AD) Global Administrator role addition to a Privileged Identity Management (PIM) user account. PIM is a service that enables you to manage, control, and monitor access to important resources in an organization. Users who are assigned to the Global administrator role can read and modify any administrative setting in your Azure AD organization.

Azure Kubernetes Rolebindings Created

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Privilege Escalation ·

Share on:

Identifies the creation of role binding or cluster role bindings. You can assign these roles to Kubernetes subjects (users, groups, or service accounts) with role bindings and cluster role bindings. An adversary who has permissions to create bindings and cluster-bindings in the cluster can create a binding to the cluster-admin ClusterRole or to other high privileges roles.

Azure Privilege Identity Management Role Modified

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Persistence ·

Share on:

Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in an organization. PIM can be used to manage the built-in Azure resource roles such as Global Administrator and Application Administrator. An adversary may add a user to a PIM role in order to maintain persistence in their target's environment or modify a PIM role to weaken their target's security controls.

Azure Service Principal Addition

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Defense Evasion ·

Share on:

Identifies when a new service principal is added in Azure. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity.

Azure Service Principal Credentials Added

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Impact ·

Share on:

Identifies when new Service Principal credentials have been added in Azure. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements.

Azure Storage Account Key Regenerated

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Tactic: Credential Access ·

Share on:

Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring credentials to access systems and resources.

External User Added to Google Workspace Group

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Tactic: Initial Access Resources: Investigation Guide ·

Share on:

Detects an external Google Workspace user account being added to an existing group. Adversaries may add external user accounts as a means to intercept shared files or emails with that specific group.

GCP IAM Custom Role Creation

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Initial Access ·

Share on:

Identifies an Identity and Access Management (IAM) custom role creation in Google Cloud Platform (GCP). Custom roles are user-defined, and allow for the bundling of one or more supported permissions to meet specific needs. Custom roles will not be updated automatically and could lead to privilege creep if not carefully scrutinized.

GCP IAM Role Deletion

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Impact ·

Share on:

Identifies an Identity and Access Management (IAM) role deletion in Google Cloud Platform (GCP). A role contains a set of permissions that allows you to perform specific actions on Google Cloud resources. An adversary may delete an IAM role to inhibit access to accounts utilized by legitimate users.

GCP IAM Service Account Key Deletion

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly.

GCP Service Account Creation

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

Identifies when a new service account is created in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If service accounts are not tracked and managed properly, they can present a security risk. An adversary may create a new service account to use during their operations in order to avoid using a standard user account and attempt to evade detection.

GCP Service Account Deletion

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Impact ·

Share on:

Identifies when a service account is deleted in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may delete a service account in order to disrupt their target's business operations.

GCP Service Account Disabled

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Impact ·

Share on:

Identifies when a service account is disabled in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may disable a service account in order to disrupt to disrupt their target's business operations.

GCP Service Account Key Creation

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a security risk. An adversary may create a new key for a service account in order to attempt to abuse the permissions assigned to that account and evade detection.

GCP Storage Bucket Configuration Modification

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Defense Evasion ·

Share on:

Identifies when the configuration is modified for a storage bucket in Google Cloud Platform (GCP). An adversary may modify the configuration of a storage bucket in order to weaken the security controls of their target's environment.

GCP Storage Bucket Permissions Modification

Jun 22, 2023 · Domain: Cloud Data Source: GCP Data Source: Google Cloud Platform Use Case: Identity and Access Audit Tactic: Defense Evasion ·

Share on:

Identifies when the Identity and Access Management (IAM) permissions are modified for a Google Cloud Platform (GCP) storage bucket. An adversary may modify the permissions on a storage bucket to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss.

Google Workspace Admin Role Assigned to a User

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Tactic: Persistence Resources: Investigation Guide ·

Share on:

Assigning the administrative role to a user will grant them access to the Google Admin console and grant them administrator privileges which allow them to access and manage various resources and applications. An adversary may create a new administrator account for persistence or apply the admin role to an existing user to carry out further intrusion efforts. Users with super-admin privileges can bypass single-sign on if enabled in Google Workspace.

Google Workspace Admin Role Deletion

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Tactic: Impact Resources: Investigation Guide ·

Share on:

Detects when a custom admin role is deleted. An adversary may delete a custom admin role in order to impact the permissions or capabilities of system administrators.

Google Workspace API Access Granted via Domain-Wide Delegation of Authority

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Persistence ·

Share on:

Detects when a domain-wide delegation of authority is granted to a service account. Domain-wide delegation can be configured to grant third-party and internal applications to access the data of Google Workspace users. An adversary may configure domain-wide delegation to maintain access to their target’s data.

Google Workspace Custom Admin Role Created

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Persistence ·

Share on:

Detects when a custom admin role is created in Google Workspace. An adversary may create a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment.

Google Workspace Password Policy Modified

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Tactic: Persistence Resources: Investigation Guide ·

Share on:

Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls.

Google Workspace Role Modified

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Persistence ·

Share on:

Detects when a custom admin role or its permissions are modified. An adversary may modify a custom admin role in order to elevate the permissions of other user accounts and persist in their target’s environment.

Google Workspace Suspended User Account Renewed

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Tactic: Initial Access ·

Share on:

Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended user account to maintain access to the Google Workspace organization with a valid account.

MFA Disabled for Google Workspace Organization

Jun 22, 2023 · Domain: Cloud Data Source: Google Workspace Use Case: Identity and Access Audit Tactic: Persistence Resources: Investigation Guide ·

Share on:

Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls.

Microsoft 365 Exchange Management Group Role Assignment

Jun 22, 2023 · Domain: Cloud Data Source: Microsoft 365 Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

Identifies when a new role is assigned to a management group in Microsoft 365. An adversary may attempt to add a role in order to maintain persistence in an environment.

Microsoft 365 Exchange Safe Link Policy Disabled

Jun 22, 2023 · Domain: Cloud Data Source: Microsoft 365 Use Case: Identity and Access Audit Tactic: Initial Access ·

Share on:

Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contain hyperlinks, even after they have been delivered to a user.

Microsoft 365 Global Administrator Role Assigned

Jun 22, 2023 · Domain: Cloud Data Source: Microsoft 365 Use Case: Identity and Access Audit Tactic: Persistence ·

Share on:

In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources.

Multi-Factor Authentication Disabled for an Azure User

Jun 22, 2023 · Domain: Cloud Data Source: Azure Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Persistence ·

Share on:

Identifies when multi-factor authentication (MFA) is disabled for an Azure user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account.

New or Modified Federation Domain

Jun 22, 2023 · Domain: Cloud Data Source: Microsoft 365 Use Case: Identity and Access Audit Tactic: Privilege Escalation ·

Share on:

Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider.

O365 Excessive Single Sign-On Logon Errors

Jun 22, 2023 · Domain: Cloud Data Source: Microsoft 365 Use Case: Identity and Access Audit Tactic: Credential Access ·

Share on:

Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token.

Okta ThreatInsight Threat Suspected Promotion

Jun 22, 2023 · Use Case: Identity and Access Audit Data Source: Okta ·

Share on:

Okta ThreatInsight is a feature that provides valuable debug data regarding authentication and authorization processes, which is logged in the system. Within this data, there is a specific field called threat_suspected, which represents Okta's internal evaluation of the authentication or authorization workflow. When this field is set to True, it suggests the presence of potential credential access techniques, such as password-spraying, brute-forcing, replay attacks, and other similar threats.

Possible Consent Grant Attack via Azure-Registered Application

Jun 22, 2023 · Domain: Cloud Data Source: Azure Data Source: Microsoft 365 Use Case: Identity and Access Audit Resources: Investigation Guide Tactic: Initial Access ·

Share on:

Detects when a user grants permissions to an Azure-registered application or when an administrator grants tenant-wide permissions to an application. An adversary may create an Azure-registered application that requests access to data such as contact information, email, or documents.

Possible Okta DoS Attack

Jun 22, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Impact ·

Share on:

Detects possible Denial of Service (DoS) attacks against an Okta organization. An adversary may attempt to disrupt an organization's business operations by performing a DoS attack against its Okta service.

Potential Password Spraying of Microsoft 365 User Accounts

Jun 22, 2023 · Domain: Cloud Data Source: Microsoft 365 Use Case: Identity and Access Audit Tactic: Credential Access ·

Share on:

Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts.

Suspicious Activity Reported by Okta User

Jun 22, 2023 · Use Case: Identity and Access Audit Data Source: Okta Tactic: Initial Access ·

Share on:

Detects when a user reports suspicious activity for their Okta account. These events should be investigated, as they can help security teams identify when an adversary is attempting to gain access to their network.