CISA Releases Azure, Microsoft 365 Malicious Activity Detection Tool

The Cybersecurity and Infrastructure Security Agency (CISA) has released a PowerShell-based tool that helps detect potentially compromised applications and accounts in Azure/Microsoft 365 environments.

This comes after Microsoft disclosed how stolen credentials and access tokens are actively being used by threat actors to target Azure customers.

Azure administrators are strongly recommended to review both these articles to learn more about these attacks and to discover how to spot anomalous behavior in their tenants.

“CISA has created a free tool for detecting unusual and potentially malicious activity that threatens users and applications in an Azure/Microsoft O365 environment,” the US federal agency said.

“The tool is intended for use by incident responders and is narrowly focused on activity that is endemic to the recent identity- and authentication-based attacks seen in multiple sectors.”

How CISA’s tool works

The PowerShell-based tool created by CISA’s Cloud Forensics team and dubbed Sparrow can be used to narrow down larger sets of investigation modules and telemetry “to those specific to recent attacks on federated identity sources and applications.”

Also Read: Computer Misuse Act Singapore: The Truth And Its Offenses

Sparrow checks the unified Azure/M365 audit log for indicators of compromise (IoCs), lists Azure AD domains, and checks Azure service principals and their Microsoft Graph API permissions to discover potential malicious activity.

The full list of checks it does once launched on the analysis machine includes:

• Searches for any modifications to the domain and federation settings on a tenant’s domain
• Searches for any modifications or credential modifications to an application
• Searches for any modifications or credential modifications to a service principal
• Searches for any app role assignments to service principals, users, and groups
• Searches for any OAuth or application consents
• Searches for SAML token usage anomaly (UserAuthenticationValue of 16457) in the Unified Audit Logs
• Searches for PowerShell logins into mailboxes
• Searches for well-known AppID for Exchange Online PowerShell
• Searches for well-known AppID for PowerShell
• Searches for the AppID to see if it accessed mail items
• Searches for the AppID to see if it accessed Sharepoint or OneDrive items
• Searches for WinRM useragent string in the user logged in and user login failed operations

Free Azure security tool also released by CrowdStrike

Cybersecurity firm CrowdStrike released a similar detection tool after investigating a failed hack following a warning received from Microsoft of a compromised Microsoft Azure reseller’s account having attempted to read the company’s emails using compromised Azure credentials.

After analyzing internal and production environments following the SolarWinds breach, CrowdStrike said last week it found no evidence of being impacted in the supply chain attack.

However, a second investigation was started following Microsoft’s alert that came while Crowdstrike was looking for IOCs associated with the SolarWinds hackers in their environment.

After analyzing their Azure environment and finding no evidence of compromise, Crowdstrike also found that Azure’s administrative tools were “particularly challenging” to use.

Also Read: Personal Data Websites: 3 Things That You Must Be Informed

To help admins analyze their Azure environments and get an easier overview of what privileges are assigned to third-party resellers and partners, CrowdStrike released the free CrowdStrike Reporting Tool for Azure (CRT) tool.