Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Add exceptions for non-interactive signin failures for Entra M365 Bruteforce #4405

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Rule Tuning] Add exceptions for non-interactive signin failures for Entra M365 Bruteforce #4405

wants to merge 1 commit into from

Conversation

jvalente-salemstate
Copy link
Contributor

@jvalente-salemstate jvalente-salemstate commented Jan 22, 2025 •
edited
Loading

Include exceptions for error codes, restricted to NonInteractiveUserSignInLogs and token refreshes:

  • 70043 : Refresh token expired or no longer valid due to conditional access frequency checks
  • 70044 : Session expired or no longer valid due to conditional access frequency checks
  • 50057 : User account is disabled

Failures in the first two cases are the result of logins that were both successful and have passed an applicable Conditional Access policy. The third code simply avoids alerts from an account that's been disabled but still is seeing noninteractive sign-in attempts.

There is a possibility of false negatives in the cases of (invalidated) token theft, but this is neither true case of "brute force", and a detection rule specifically for token theft would be better suited for this.

Pull Request

Issue link(s):

Summary - What I changed

To exclude non-interactive signins for a token refresh, I've modified the query to include

  and not (azure.signinlogs.category == "NonInteractiveUserSignInLogs"
      and azure.signinlogs.properties.status.error_code in (70043, 70044, 50057)
      and azure.signinlogs.properties.incoming_token_type in ("primaryRefreshToken", "refreshToken"))

Contributor checklist

@jvalente-salemstate
Add exceptions for non-interactive signin failures.
e1dcce1 
Include exceptions for error codes, restricted to `NonInteractiveUserSignInLogs` and token refreshes:

- 70043 : Refresh token expired or no longer valid due to conditional access frequency checks
- 70044 : Session expired or no longer valid due to conditional access frequency checks
- 50057 : User account is disabled
@botelastic botelastic bot added Domain: Cloud Integration: Azure azure related rules labels Jan 22, 2025
@terrancedejesus terrancedejesus self-assigned this Jan 22, 2025
@Mikaayenson Mikaayenson added the Rule: Tuning tweaking or tuning an existing rule label Jan 24, 2025
@github-actions GitHub Actions
Copy link
Contributor

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@terrancedejesus terrancedejesus

Labels
backport: auto community Domain: Cloud Integration: Azure azure related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Rule Tuning] Azure Entra Sign-in Brute Force against Microsoft 365 Accounts
3 participants
@jvalente-salemstate @Mikaayenson @terrancedejesus