Skip to content

[Rule Tuning] Standardize Azure / M365 Rule Contents #5035

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 10 commits into
base: main
Choose a base branch
from
Draft

[Rule Tuning] Standardize Azure / M365 Rule Contents #5035

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
35553e8
initial adjustments to Azure ruleset
terrancedejesus Aug 28, 2025
9a76608
updated azure tags
terrancedejesus Aug 28, 2025
1f3e5c2
updated m365 rules
terrancedejesus Aug 29, 2025
d481dad
removed deprecated rule change
terrancedejesus Aug 29, 2025
29b3cb7
resolving conflicts
terrancedejesus Sep 2, 2025
64a1d8b
resolving conflicts
terrancedejesus Sep 2, 2025
78476c3
resolving conflicts
terrancedejesus Sep 2, 2025
2953fdd
updated rule names
terrancedejesus Sep 2, 2025
2ec97bb
updated tags, rules names
terrancedejesus Sep 3, 2025
12eef14
updated name and tags
terrancedejesus Sep 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions rules/cross-platform/initial_access_azure_o365_with_network_alert.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/04/29"
integration = ["azure", "o365"]
maturity = "production"
updated_date = "2025/07/30"
updated_date = "2025/08/29"

[rule]
author = ["Elastic"]
Expand All @@ -17,12 +17,13 @@ false_positives = [
""",
]
from = "now-60m"
interval = "59m"
language = "esql"
license = "Elastic License v2"
name = "Microsoft 365 or Entra ID Sign-in from a Suspicious Source"
name = "M365 or Entra ID Sign-in from a Suspicious Source"
note = """## Triage and analysis

### Investigating Microsoft 365 or Entra ID Sign-in from a Suspicious Source
### Investigating M365 or Entra ID Sign-in from a Suspicious Source

#### Possible investigation steps

Expand Down Expand Up @@ -63,7 +64,7 @@ tags = [
"Domain: Cloud",
"Domain: SaaS",
"Data Source: Azure",
"Data Source: Entra ID",
"Data Source: Microsoft Entra ID",
"Data Source: Entra ID Sign-in Logs",
"Data Source: Microsoft 365",
"Data Source: Microsoft 365 Audit Logs",
Expand Down
7 changes: 4 additions & 3 deletions ...sharepoint_access_for_user_principal.toml → ...sharepoint_access_for_user_principal.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/05/01"
integration = ["azure"]
maturity = "production"
updated_date = "2025/05/07"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -30,10 +30,10 @@ from = "now-9m"
index = ["logs-azure.signinlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Microsoft Entra ID SharePoint Access for User Principal via Auth Broker"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice initiative, but what is the reason for dropping this? I think it helps with context, and it is referred by MS always as Microsoft Entra ID, like:

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@w0rk3r - Great question. Here are a few reasons I decided to drop the Microsoft string unless absolutely necessary for context.

  • Keeping cloud rule names concise. If we enforce putting Microsoft behind every service, the rule names can get long and redundant. Example User Session Reuse from Microsoft Entra ID to Microsoft Graph in Microsoft Azure
  • Entra ID is unique in itself and there should be no naming conflicts where context may be missed. However, for example, we should use Microsoft Graph as Graph alone can be vague.
  • We don't use Microsoft Azure everywhere, simple Azure as we assume subjectively users know what Azure is. IMO we can say the same for Entra ID or M365.
  • Contextually the full product or service name should be throughout the rule contents itself. We fully say "Microsoft Entra ID", etc. in the description, investigation guides, tags, etc. so it is not missing.

Honestly, if we don't care too much about redundancy or length, I dont have a strong judgment against using the full service/product naming.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes perfect sense, I think it is positive ++

name = "Entra ID SharePoint Access for User Principal via Auth Broker"
note = """## Triage and analysis
### Investigating Microsoft Entra ID SharePoint Access for User Principal via Auth Broker
### Investigating Entra ID SharePoint Access for User Principal via Auth Broker
This rule identifies non-interactive sign-ins to SharePoint Online via the Microsoft Authentication Broker application using a refresh token or Primary Refresh Token (PRT). This type of activity may indicate token replay attacks, OAuth abuse, or automated access from previously consented apps or stolen sessions.
Expand Down Expand Up @@ -82,6 +82,7 @@ To use this rule, ensure that Microsoft Entra ID Sign-In Logs are being collecte
severity = "high"
tags = [
"Domain: Cloud",
"Domain: Identity",
"Use Case: Identity and Access Audit",
"Tactic: Collection",
"Data Source: Azure",
Expand Down
21 changes: 13 additions & 8 deletions ...ollection_update_event_hub_auth_rule.toml → ...lection_event_hub_created_or_updated.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/08/18"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand All @@ -21,10 +21,10 @@ false_positives = [
""",
]
from = "now-25m"
index = ["filebeat-*", "logs-azure*"]
index = ["filebeat-*", "logs-azure.activitylogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure Event Hub Authorization Rule Created or Updated"
name = "Event Hub Authorization Rule Created or Updated"
note = """## Triage and analysis

> **Disclaimer**:
Expand Down Expand Up @@ -59,15 +59,20 @@ Azure Event Hub Authorization Rules manage access to Event Hubs via cryptographi
- Escalate the incident to the security operations team for further investigation and to determine if additional systems or data have been compromised.
- Conduct a security review of all Event Hub Authorization Rules to ensure that only necessary permissions are granted and that the RootManageSharedAccessKey is not used in applications.
- Enhance monitoring and alerting for changes to authorization rules by integrating with a Security Information and Event Management (SIEM) system to detect similar threats in the future.

## Setup

The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
"""
references = ["https://docs.microsoft.com/en-us/azure/event-hubs/authorize-access-shared-access-signature"]
risk_score = 47
rule_id = "b6dce542-2b75-4ffb-b7d6-38787298ba9d"
severity = "medium"
tags = ["Domain: Cloud", "Data Source: Azure", "Use Case: Log Auditing", "Tactic: Collection", "Resources: Investigation Guide"]
tags = [
"Domain: Cloud",
"Domain: Storage",
"Data Source: Azure",
"Data Source: Azure Activity Logs",
"Use Case: Log Auditing",
"Tactic: Collection",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

Expand Down
6 changes: 4 additions & 2 deletions .../integrations/azure/collection_graph_email_access_by_unusual_public_client_via_graph.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/05/06"
integration = ["azure"]
maturity = "production"
updated_date = "2025/05/06"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand All @@ -18,7 +18,7 @@ from = "now-9m"
index = ["filebeat-*", "logs-azure.graphactivitylogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Suspicious Email Access by First-Party Application via Microsoft Graph"
name = "Graph Suspicious Email Access by First-Party Application via Microsoft Graph"
note = """## Triage and analysis

### Investigating Suspicious Email Access by First-Party Application via Microsoft Graph
Expand Down Expand Up @@ -67,6 +67,8 @@ rule_id = "e882e934-2aaa-11f0-8272-f661ea17fbcc"
severity = "medium"
tags = [
"Domain: Cloud",
"Domain: SaaS",
"Domain: Email",
"Data Source: Azure",
"Data Source: Microsoft Graph",
"Data Source: Microsoft Graph Activity Logs",
Expand Down
8 changes: 4 additions & 4 deletions rules/integrations/azure/credential_access_entra_id_brute_force_activity.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ integration = ["azure"]
maturity = "production"
min_stack_comments = "Elastic ESQL values aggregation is more performant in 8.16.5 and above."
min_stack_version = "8.17.0"
updated_date = "2025/07/16"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand All @@ -25,10 +25,10 @@ from = "now-60m"
interval = "15m"
language = "esql"
license = "Elastic License v2"
name = "Microsoft Entra ID Sign-In Brute Force Activity"
name = "Entra ID Sign-In Brute Force Activity"
note = """## Triage and analysis

### Investigating Microsoft Entra ID Sign-In Brute Force Activity
### Investigating Entra ID Sign-In Brute Force Activity

This rule detects brute-force authentication activity in Entra ID sign-in logs. It classifies failed sign-in attempts into behavior types such as password spraying, credential stuffing, or password guessing. The classification (`bf_type`) helps prioritize triage and incident response.

Expand Down Expand Up @@ -79,7 +79,7 @@ tags = [
"Domain: Cloud",
"Domain: Identity",
"Data Source: Azure",
"Data Source: Entra ID",
"Data Source: Microsoft Entra ID",
"Data Source: Entra ID Sign-in Logs",
"Use Case: Identity and Access Audit",
"Use Case: Threat Detection",
Expand Down
4 changes: 3 additions & 1 deletion rules/integrations/azure/credential_access_entra_id_device_code_auth_with_broker_client.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2024/06/24"
integration = ["azure"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand All @@ -27,8 +27,10 @@ This rule optionally requires Azure Sign-In logs from the Azure integration. Ens
severity = "medium"
tags = [
"Domain: Cloud",
"Domain: Identity",
"Data Source: Azure",
"Data Source: Microsoft Entra ID",
"Data Source: Entra ID Sign-in Logs",
"Use Case: Identity and Access Audit",
"Tactic: Credential Access",
"Resources: Investigation Guide",
Expand Down
6 changes: 3 additions & 3 deletions rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/07/01"
integration = ["azure"]
maturity = "production"
updated_date = "2025/07/16"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand All @@ -21,7 +21,7 @@ from = "now-60m"
interval = "15m"
language = "esql"
license = "Elastic License v2"
name = "Microsoft Entra ID Exccessive Account Lockouts Detected"
name = "Entra ID Excessive Account Lockouts Detected"
note = """## Triage and analysis

### Investigating Microsoft Entra ID Exccessive Account Lockouts Detected
Expand Down Expand Up @@ -73,7 +73,7 @@ tags = [
"Domain: Cloud",
"Domain: Identity",
"Data Source: Azure",
"Data Source: Entra ID",
"Data Source: Microsoft Entra ID",
"Data Source: Entra ID Sign-in Logs",
"Use Case: Identity and Access Audit",
"Use Case: Threat Detection",
Expand Down
6 changes: 4 additions & 2 deletions ...ess_first_time_seen_device_code_auth.toml → ..._id_first_time_seen_device_code_auth.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2024/10/14"
integration = ["azure"]
maturity = "production"
updated_date = "2025/02/21"
updated_date = "2025/08/28"

[rule]
author = ["Elastic", "Matteo Potito Giorgio"]
Expand All @@ -16,7 +16,7 @@ from = "now-9m"
index = ["filebeat-*", "logs-azure.signinlogs-*", "logs-azure.activitylogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "First Occurrence of Entra ID Auth via DeviceCode Protocol"
name = "Entra ID First Occurrence of Auth via DeviceCode Protocol"
note = """## Triage and analysis

### Investigating First Occurrence of Entra ID Auth via DeviceCode Protocol
Expand Down Expand Up @@ -86,8 +86,10 @@ setup = "This rule optionally requires Azure Sign-In logs from the Azure integra
severity = "medium"
tags = [
"Domain: Cloud",
"Domain: Identity",
"Data Source: Azure",
"Data Source: Microsoft Entra ID",
"Data Source: Entra ID Sign-in Logs",
"Use Case: Identity and Access Audit",
"Tactic: Credential Access",
"Resources: Investigation Guide",
Expand Down
6 changes: 3 additions & 3 deletions ...tra_signin_brute_force_microsoft_365.toml → ..._id_signin_brute_force_microsoft_365.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2024/09/06"
integration = ["azure"]
maturity = "production"
updated_date = "2025/07/16"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand All @@ -23,7 +23,7 @@ from = "now-60m"
interval = "15m"
language = "esql"
license = "Elastic License v2"
name = "Microsoft 365 Brute Force via Entra ID Sign-Ins"
name = "M365 Brute Force via Entra ID Sign-Ins"
note = """## Triage and analysis

### Investigating Microsoft 365 Brute Force via Entra ID Sign-Ins
Expand Down Expand Up @@ -77,7 +77,7 @@ tags = [
"Domain: SaaS",
"Domain: Identity",
"Data Source: Azure",
"Data Source: Entra ID",
"Data Source: Microsoft Entra ID",
"Data Source: Entra ID Sign-in Logs",
"Use Case: Identity and Access Audit",
"Use Case: Threat Detection",
Expand Down
9 changes: 5 additions & 4 deletions ...access_azure_entra_suspicious_signin.toml → ...al_access_entra_id_suspicious_signin.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/04/28"
integration = ["azure"]
maturity = "production"
updated_date = "2025/07/16"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand All @@ -20,10 +20,10 @@ false_positives = [
from = "now-60m"
language = "esql"
license = "Elastic License v2"
name = "Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties"
name = "Entra ID Concurrent Sign-Ins with Suspicious Properties"
note = """## Triage and analysis

### Investigating Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties
### Investigating Entra ID Concurrent Sign-Ins with Suspicious Properties

### Possible investigation steps

Expand Down Expand Up @@ -56,9 +56,10 @@ This rule requires the Azure logs integration be enabled and configured to colle
severity = "high"
tags = [
"Domain: Cloud",
"Domain: Identity",
"Domain: SaaS",
"Data Source: Azure",
"Data Source: Entra ID",
"Data Source: Microsoft Entra ID",
"Data Source: Entra ID Sign-in",
"Use Case: Identity and Access Audit",
"Use Case: Threat Detection",
Expand Down
8 changes: 4 additions & 4 deletions ...zure_entra_totp_brute_force_attempts.toml → ...s_entra_id_totp_brute_force_attempts.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2024/12/11"
integration = ["azure"]
maturity = "production"
updated_date = "2025/07/31"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand All @@ -21,10 +21,10 @@ false_positives = [
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Microsoft Entra ID MFA TOTP Brute Force Attempts"
name = "Entra ID MFA TOTP Brute Force Attempts"
note = """## Triage and analysis

### Investigating Microsoft Entra ID MFA TOTP Brute Force Attempts
### Investigating Entra ID MFA TOTP Brute Force Attempts

This rule detects brute force attempts against Azure Entra multi-factor authentication (MFA) Time-based One-Time Password (TOTP) verification codes. It identifies high-frequency failed TOTP code attempts for a single user in a short time-span with a high number of distinct session IDs. Adversaries may programmatically attempt to brute-force TOTP codes by generating several sessions and attempting to guess the correct code.

Expand Down Expand Up @@ -74,7 +74,7 @@ tags = [
"Domain: Cloud",
"Domain: Identity",
"Data Source: Azure",
"Data Source: Entra ID",
"Data Source: Microsoft Entra ID",
"Data Source: Entra ID Sign-in logs",
"Use Case: Identity and Access Audit",
"Use Case: Threat Detection",
Expand Down
9 changes: 4 additions & 5 deletions ..._azure_key_vault_excessive_retrieval.toml → ...access_key_vault_excessive_retrieval.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/07/10"
integration = ["azure"]
maturity = "production"
updated_date = "2025/07/24"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -30,10 +30,10 @@ from = "now-9m"
interval = "8m"
language = "esql"
license = "Elastic License v2"
name = "Excessive Secret or Key Retrieval from Azure Key Vault"
name = "Key Vault Excessive Secret or Key Retrieval"
note = """## Triage and analysis

### Investigating Excessive Secret or Key Retrieval from Azure Key Vault
### Investigating Key Vault Excessive Secret or Key Retrieval

Azure Key Vault is a cloud service that safeguards encryption keys and secrets like certificates, connection strings, and passwords. It is crucial for managing sensitive data in Azure environments. Unauthorized modifications to Key Vaults can lead to data breaches or service disruptions. This rule detects excessive secret or key retrieval operations from Azure Key Vault, which may indicate potential abuse or unauthorized access attempts.

Expand Down Expand Up @@ -72,11 +72,10 @@ To ensure this rule functions correctly, the following diagnostic logs must be e
severity = "medium"
tags = [
"Domain: Cloud",
"Domain: Storage",
"Domain: Identity",
"Data Source: Azure",
"Data Source: Azure Platform Logs",
"Data Source: Azure Key Vault",
"Data Source: Azure Key Vault Diagnostic Logs",
"Use Case: Threat Detection",
"Use Case: Identity and Access Audit",
"Tactic: Credential Access",
Expand Down
Loading
Loading