Skip to content

Commit 5627c46

Browse files
siigilchristophetd
siigil
and
christophetd
authored
Entra ID support + AU techniques (#566)
* Add Entra ID AU techniques. * Add AU technique documentation. * Terraform formatting fix. * Fixed typo in Restricted AU account name. * Fix typo in detonation step details * Fix typo in detonatin step details * Add error handling for Graph client * Update friendly names + remove unused codeBlock * Modify Hidden AU technique to create Backdoor user during Detonation * Update TF formatting * Fixed err handling * fix staticanalysis finding * Add Entra ID provider and regenerate docs * Fixed missing parenthesis in Hidden AU * Remove extraneous err check * Add Guest Invite techniqe, Entra ID Utils, + fix Hidden AU typo * Fix function typo * Add case in L46 to fix --platform entra-id option * New attack technique (Entra ID): entra-id.persistence.new-application * Apply suggestions from code review * make docs * Fix type in fmt.Sprintf * New attack technique (Entra ID): entra-id.persistence.backdoor-application * Update package names and regenerate docs * Enhancements to entra-id.persistence.guest-user * Enhancements to entra-id.persistence.restricted-au * Enhancements to entra-id.persistence.hidden-au * Refactor Entra ID attack techniques to be more consistent * Update docs of entra-id.persistence.hidden-au * New attack technique (Entra ID): entra-id.persistence.backdoor-application-sp * make docs * remove old azure docs * avoid importing graphmodels twice * bump MS Graph SDK --------- Co-authored-by: Christophe Tafani-Dereeper <[email protected]>
1 parent 6add391 commit 5627c46

File tree

35 files changed

+1920
-75
lines changed

35 files changed

+1920
-75
lines changed

‎docs/attack-techniques/AWS/aws.discovery.ec2-download-user-data.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ Through CloudTrail's <code>DescribeInstanceAttribute</code> event.
4848

4949
See:
5050

51-
* [Associated Sigma rule](https://github.com/SigmaHQ/sigma/blob/master/unsupported/cloud/aws_ec2_download_userdata.yml)
51+
* [Associated Sigma rule](https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/aws_ec2_download_userdata.yml)
5252

5353

5454
## Detonation logs <span class="smallcaps w3-badge w3-light-green w3-round w3-text-sand">new!</span>

‎docs/attack-techniques/entra-id/entra-id.persistence.backdoor-application-sp.md

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
title: Backdoor Entra ID application through service principal
3+
---
4+
5+
# Backdoor Entra ID application through service principal
6+
7+
8+
9+
10+
Platform: Entra ID
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Persistence
16+
- Privilege Escalation
17+
18+
## Description
19+
20+
21+
Backdoors an existing Entra ID application by creating a new credential on the associated service principal.
22+
23+
<span style="font-variant: small-caps;">Warm-up</span>:
24+
25+
- Create an Entra ID application and associated service principal
26+
- Assign it the <code>Directory Readers</code> role at the tenant level (for illustration purposes)
27+
28+
<span style="font-variant: small-caps;">Detonation</span>:
29+
30+
- Backdoor the Entra ID application by creating a new credential on the associated service principal
31+
32+
Notes: The warm-up mimics what happens when you create an App Registration through the Azure portal.
33+
When you use the Azure portal, creating an App Registration automatically creates an associated service principal.
34+
When using the Microsoft Graph API, the service principal needs to be created separately.
35+
36+
References:
37+
38+
- https://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/
39+
- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
40+
- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
41+
- https://redfoxsec.com/blog/azure-privilege-escalation-via-service-principal/
42+
43+
44+
## Instructions
45+
46+
```bash title="Detonate with Stratus Red Team"
47+
stratus detonate entra-id.persistence.backdoor-application-sp
48+
```
49+
## Detection
50+
51+
52+
Using [Entra ID audit logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs) with the activity type <code>Add service principal credentials</code>.
53+
54+

‎docs/attack-techniques/entra-id/entra-id.persistence.backdoor-application.md

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
title: Backdoor Entra ID application
3+
---
4+
5+
# Backdoor Entra ID application
6+
7+
8+
9+
10+
Platform: Entra ID
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Persistence
16+
- Privilege Escalation
17+
18+
## Description
19+
20+
21+
Backdoors an existing Entra ID application by creating a new password credential.
22+
23+
<span style="font-variant: small-caps;">Warm-up</span>:
24+
25+
- Create an Entra ID application and associated service principal
26+
- Assign it the <code>Directory Readers</code> role at the tenant level (for illustration purposes)
27+
28+
<span style="font-variant: small-caps;">Detonation</span>:
29+
30+
- Backdoor the Entra ID application by creating a new password credential
31+
32+
Notes: The warm-up mimics what happens when you create an App Registration through the Azure portal.
33+
When you use the Azure portal, creating an App Registration automatically creates an associated service principal.
34+
When using the Microsoft Graph API, the service principal needs to be created separately.
35+
36+
References:
37+
38+
- https://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/
39+
- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
40+
- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
41+
- https://redfoxsec.com/blog/azure-privilege-escalation-via-service-principal/
42+
43+
44+
## Instructions
45+
46+
```bash title="Detonate with Stratus Red Team"
47+
stratus detonate entra-id.persistence.backdoor-application
48+
```
49+
## Detection
50+
51+
52+
Using [Entra ID audit logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs) with the activity type <code>Update application – Certificates and secrets management</code>.
53+
54+

‎docs/attack-techniques/entra-id/entra-id.persistence.guest-user.md

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
title: Create Guest User
3+
---
4+
5+
# Create Guest User
6+
7+
8+
9+
10+
Platform: Entra ID
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Persistence
16+
17+
## Description
18+
19+
20+
Invites an external guest user in the tenant.
21+
22+
<span style="font-variant: small-caps;">Warm-up</span>: None
23+
24+
<span style="font-variant: small-caps;">Detonation</span>:
25+
26+
- Invite guest user (without generating an invitation email)
27+
28+
References:
29+
30+
- https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/inviting-external-users/
31+
- https://derkvanderwoude.medium.com/azure-subscription-hijacking-and-cryptomining-86c2ac018983
32+
- https://dirkjanm.io/assets/raw/US-22-Mollema-Backdooring-and-hijacking-Azure-AD-accounts_final.pdf
33+
34+
!!! note
35+
36+
By default, Stratus Red Team invites the e-mail <code>[email protected]</code>. However, you can override
37+
this behavior by setting the environment variable <code>STRATUS_RED_TEAM_ATTACKER_EMAIL</code>, for instance:
38+
39+
```bash
40+
export STRATUS_RED_TEAM_ATTACKER_EMAIL="[email protected]"
41+
stratus detonate entra-id.persistence.guest-user
42+
```
43+
44+
45+
## Instructions
46+
47+
```bash title="Detonate with Stratus Red Team"
48+
stratus detonate entra-id.persistence.guest-user
49+
```
50+
## Detection
51+
52+
53+
Using [Entra ID audit logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs) with the specific activity types:
54+
55+
- <code>Add user</code>
56+
- <code>Invite external user</code>
57+
- <code>Add user sponsor</code>
58+
59+
When the invited user accepts the invite, an additional event <code>Redeem external user invite</code> is logged.
60+
61+
Sample events, shortened for clarity:
62+
63+
```json
64+
{
65+
"category": "UserManagement",
66+
"result": "success",
67+
"activityDisplayName": "Invite external user",
68+
"loggedByService": "Invited Users",
69+
"initiatedBy": {
70+
"user": {
71+
"userPrincipalName": "<[email protected]>",
72+
}
73+
},
74+
"userAgent": "",
75+
"targetResources": [
76+
{
77+
"displayName": "<invited user display name>",
78+
"type": "User",
79+
"userPrincipalName": "<invited-user-email>#EXT#@<tenant.tld>",
80+
"groupType": null,
81+
"modifiedProperties": []
82+
}
83+
],
84+
"additionalDetails": [
85+
{
86+
"key": "invitedUserEmailAddress",
87+
"value": "<invited-user-email>"
88+
}
89+
]
90+
}
91+
{
92+
"category": "UserManagement",
93+
"result": "success",
94+
"resultReason": null,
95+
"activityDisplayName": "Redeem external user invite",
96+
"loggedByService": "B2B Auth",
97+
"initiatedBy": {
98+
"user": {
99+
"userPrincipalName": "<invited-user-email>",
100+
"ipAddress": "<invited-user-ip>"
101+
}
102+
},
103+
"targetResources": [
104+
{
105+
"id": "d042c4fe-5dd1-44a2-883a-eede6c10608f",
106+
"displayName": "UPN: <invited-user-email>#EXT#<tenant.tld>, Email: <invited-user-email>, InvitationId: 4c93fc70-169a-411f-8cf7-aff732f8c7b9, Source: One Time Passcode",
107+
"type": "User",
108+
"userPrincipalName": "<invited-user-email>#EXT#<tenant.tld>"
109+
}
110+
]
111+
}
112+
```
113+
114+

‎docs/attack-techniques/entra-id/entra-id.persistence.hidden-au.md

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
title: Create Hidden Scoped Role Assignment Through HiddenMembership AU
3+
---
4+
5+
# Create Hidden Scoped Role Assignment Through HiddenMembership AU
6+
7+
8+
9+
10+
Platform: Entra ID
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Persistence
16+
17+
## Description
18+
19+
20+
Creates an [Administrative Unit (AU)](https://learn.microsoft.com/en-us/graph/api/resources/administrativeunit?view=graph-rest-1.0) with hidden membership, and a scoped role assignment over this AU.
21+
This simulates an attacker that TODO.
22+
23+
<span style="font-variant: small-caps;">Warm-up</span>:
24+
25+
- Create the target (victim) Entra ID user
26+
27+
<span style="font-variant: small-caps;">Detonation</span>:
28+
29+
- Create an administrative unit with hidden membership
30+
- Create a backdoor Entra ID user
31+
- Add the target (victim) user to the administrative unit
32+
- Assign the backdoor user with Privileged Administration Administrator rights over the administrative unit
33+
34+
This simulates an attacker that indirectly persists their access.
35+
The backdoor user can now perform privileged operations over any user in the administrative unit, which can be used to escalate privileges or maintain access, for instance by resetting the target user's password.
36+
37+
References:
38+
39+
- https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units
40+
41+
42+
43+
## Instructions
44+
45+
```bash title="Detonate with Stratus Red Team"
46+
stratus detonate entra-id.persistence.hidden-au
47+
```
48+
## Detection
49+
50+
51+
Using [Entra ID audit logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs) with the specific activity types:
52+
53+
For <code>Service: Core Directory</code> and <code>Category: AdministrativeUnit</code>:
54+
55+
- <code>Add administrative unit</code>
56+
- <code>Add member to administrative unit</code>
57+
58+
For <code>Service: Core Directory</code> and <code>Category: RoleManagement</code>:
59+
60+
- <code>Add scoped member to role</code>
61+
62+

‎docs/attack-techniques/entra-id/entra-id.persistence.new-application.md

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
title: Create Application
3+
---
4+
5+
# Create Application
6+
7+
8+
9+
10+
Platform: Entra ID
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Persistence
16+
- Privilege Escalation
17+
18+
## Description
19+
20+
21+
Creates a new Entra ID application to backdoor the tenant.
22+
23+
<span style="font-variant: small-caps;">Warm-up</span>: None
24+
25+
<span style="font-variant: small-caps;">Detonation</span>:
26+
27+
- Create a new Entra ID application
28+
- Create a password credential for the application
29+
- Create a service principal for the application
30+
- Assign the Global Administrator role to the application
31+
- Print the command to retrieve a Graph API access token
32+
33+
References:
34+
35+
- https://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/
36+
- https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
37+
38+
## Instructions
39+
40+
```bash title="Detonate with Stratus Red Team"
41+
stratus detonate entra-id.persistence.new-application
42+
```
43+
## Detection
44+
45+
46+
Using [Entra ID audit logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs) with the specific activity types:
47+
48+
- <code>Add application</code>
49+
- <code>Update application – Certificates and secrets management</code>
50+
- <code>Add member to role</code>
51+
52+

0 commit comments

Comments
 (0)