Detect entra token request via specific BOF (IOC based)

Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This might be one of the silliest detections I have created. But since there is a Beacon Object File out there which can be used to directly request Entra ID access tokens from an active beacon on a device using a specific User Agent, we can easily detect this beacon file by flagging the funny user agent and / or scope identifier that is used.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1651` Cloud Administration Command
Credential Access	`T1606` Forge Web Credentials

References

https://github.com/trustedsec/CS-Remote-OPs-BOF/blob/12850f1d9306ccdec21f2b4e9dd16f78b0b949a9/src/Remote/get_azure_token/entry.c#L260

Telemetry coverage

Platform	Record / event type
Azure	Target application: Sign-in naming a target application

Rule body

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(5m)
| where UserAgent contains "ur mum" 
| where ResourceIdentity == "797f4846-ba00-4fd7-ba43-dac1f8f63013"

Stages and Predicates

Stage 1: `source`

AADNonInteractiveUserSignInLogs

Stage 2: `where`

| where TimeGenerated > ago(5m)

Stage 3: `where`

| where UserAgent contains "ur mum"

Stage 4: `where`

| where ResourceIdentity == "797f4846-ba00-4fd7-ba43-dac1f8f63013"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ResourceIdentity`	eq	`797f4846-ba00-4fd7-ba43-dac1f8f63013`	`field:"ResourceIdentity" kind:eq value:"797f4846-ba00-4fd7-ba43-dac1f8f63013"`
`UserAgent`	contains	`ur mum`	`field:"aws::userAgent" kind:contains value:"ur mum"`