Detection Engineering in Azure & Introducing AzDetectSuite

Azure Threat Research Matrix and AzDetectSuite

Azure Threat Research Matrix (ATRM), which highlighted the potential techniques an adversary could abuse within Azure & AzureAD. The immediate thought would be to give clients an idea of what potential abuse scenarios exist when they decide to use a certain resource or feature. 

AzDetectSuite is a project created to allow Azure users to establish a basic defense within Azure by giving pre-built KQL queries for each technique within ATRM that are deployable Alerts to Azure Monitor. ATRM, most (85%+) techniques will have a KQL query and a button that will deploy the query to their Azure subscription.

The queries live within a publicly available GitHub repository and can openly be reviewed, Pull Requested, and critiqued. These queries are not a “one-size-fits-all” and are mostly geared towards smaller environments since they are alerting off of more basic telemetry, so use at your own discretion. Within the repository is also a PowerShell script, Invoke-AzDetectSuite.ps1, which will import an entire tactic’s detections for every technique within it, or it can also just import all available

AzDetectSuite vs Microsoft Defender for Cloud

AzDetectSuite (ADS) is not meant to compete with Microsoft Defender for Cloud (MDC). MDC provides advanced detections based on your subscription plan and will give more granular control based on the telemetry in a tenant. ADS is meant to be an open source suite of basic detections for techniques found within ATRM, as MDC is not comprehensive in its coverage for techniques found in ATRM. MDC’s capabilities far exceed ADS, as it is a subscription-based service with more insight into a resource’s telemetry than what is provided to users. In comparison, ADS is open source and is more targeted towards smaller environments that want to ensure their resources are secure from potential abuse. In addition, ADS has some additional detections that utilize agents as well. For example, ADS has a detection that when combined with PowerShell scriptblock logging, will tell you what command was run when someone utilizes RunCommand on an AzureVM. For larger environments, it is recommended to go through ADS and determine which detections will be suitable for your environment and that may compliment MDC. detections.

In Azure, logs are centralized to Azure Monitor. Azure Monitor will ingest data from hundreds of log sources.  These sources range from the general Azure Log (AzureActivity) to more detailed logs, such as Service Principal Sign-Ins (AADServicePrincipalSignInLogs). Writing a basic detection for Azure is very easy, so it is necessary to ask a few questions before developing a detection:

1. How broad should this detection be?

  • General alert on a single action
  • Specific alert when an action meets a certain condition

2. What are you trying to alert on?

  • An action in a Resource?
  • Whenever a user or service principal logs in?
  • Whenever a new resource is created?

3. Does the resource action ever occur legitimately?

  • Part of sysadmin’s routines
  • Can you minimize false positives through more granular data?

4. What steps should be taken once the alert fires?

  • Enable a runbook?
  • Email/Text appropriate parties

Using Kusto Query Language (KQL), a basic detection for something such as RunCommand on a Virtual Machine looks like this:

AzureActivity | where OperationNameValue == 'MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION'

Where ‘AzureActivity’ is the log provider and the logs are then filtered to look for when the OperationNameValue property matches ‘MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION’

Reference