Query: alert when Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e
Matching passage: Sigma rule: Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. Logsource: windows / image_load. Rule: title: Potential Azure Browser SSO Abuse id: 50f852e6-af22-4c78-9ede-42ef36aa3453 status: test description: 'Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user. ' references: - https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30 author: Den Iuzvyk date: 2020-07-15 modified: 2023-04-18 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded: C:\Windows\System32\MicrosoftAccountTokenProvider.dll filter_main_bgtaskhost: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ Image|endswith: \BackgroundTaskHost.exe filter_optional_devenv: Image|startswith: - C:\Program Files\Microsoft Visual Studio\ - C:\Program Files (x86)\Microsoft Visual Studio\ Image|endswith: \IDE\devenv.exe filter_optional_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_optional_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_optional_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_onedrive: Image|endswith: \AppData\Local\Microsoft\OneDrive\OneDrive.exe filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - False positives are expected since this rules is only looking for the DLL load event. This rule is better used in correlation with related activity level: low
Near-miss passage: Sigma rule: Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall. Logsource: windows / process_creation. Rule: title: Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE id: a35f5a72-f347-4e36-8895-9869b0d5fc6d status: test description: Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall references: - https://www.virusradar.com/en/Win32_Kasidet.AD/description - https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100 author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community date: 2020-05-25 modified: 2023-12-11 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: - CommandLine|contains|all: - firewall - add - allowedprogram - CommandLine|contains|all: - advfirewall - firewall - add - rule - action=allow - program= selection_paths: CommandLine|contains: - :\$Recycle.bin\ - :\RECYCLER.BIN\ - :\RECYCLERS.BIN\ - :\SystemVolumeInformation\ - :\Temp\ - :\Users\Default\ - :\Users\Desktop\ - :\Users\Public\ - :\Windows\addins\ - :\Windows\cursors\ - :\Windows\debug\ - :\Windows\drivers\ - :\Windows\fonts\ - :\Windows\help\ - :\Windows\system32\tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \Downloads\ - \Local Settings\Temporary Internet Files\ - \Temporary Internet Files\Content.Outlook\ - '%Public%\' - '%TEMP%' - '%TMP%' condition: all of selection_* falsepositives: - Unknown level: high