Azure DevOps Audit Detection for known malicious tooling

Status: available
Severity: high
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

'Azure DevOps has been targeted over the years with a handful of toolkits. This detection will look for some common signs known for a few of these tools.'

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1119` Automated Collection

Rule body

id: bc71cf84-c02c-4c0a-a64c-306d84f9ff89
name: Azure DevOps Audit Detection for known malicious tooling
description: |
  'Azure DevOps has been targeted over the years with a handful of toolkits.  This detection will look for some common signs known for a few of these tools.'
severity: High
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Collection
relevantTechniques:
  - T1119
query: |
  ADOAuditLogs
  // Look for known bad user agents
  | where UserAgent has_any ("ADOKit")
  | extend timestamp = TimeGenerated
  | extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorUPN
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IpAddress
version: 1.0.4
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ADOAuditLogs

Stage 2: `where`

| where UserAgent has_any ("ADOKit")

Stage 3: `extend`

| extend timestamp = TimeGenerated

Stage 4: `extend`

| extend AccountName = tostring(split(ActorUPN, "@")[0]), AccountUPNSuffix = tostring(split(ActorUPN, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`UserAgent`	match	`ADOKit` transforms: `term`	`field:"aws::userAgent" kind:match value:"ADOKit"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`timestamp`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`