CA Policy Updated by Non Approved Actor

Status: test
Severity: medium
Log source: product azure, service auditlogs
Author: Corissa Koopmans, '@corissalea'
Source: github.com/SigmaHQ/sigma

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Known false positives

Misconfigured role permissions
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556` Modify Authentication Process
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism
Defense Impairment	`T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Telemetry coverage

Platform	Record / event type
Azure	Update conditional access policy

Rules detecting the same action

These rules filter on the same operation.

Azure MFA Disabled (Panther)
Azure Policy Violation Detected (Panther)
CA Policy Removed by Non Approved Actor (Sigma)
Certificate-Based Authentication Enabled (Sigma)
Changes to Device Registration Policy (Sigma)
Conditional Access - A Conditional Access app exclusion has changed (Kusto)
Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) (Kusto)
Conditional Access - A Conditional Access policy was deleted (Kusto)

Rule body

title: CA Policy Updated by Non Approved Actor
id: 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
status: test
description: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
author: Corissa Koopmans, '@corissalea'
date: 2022-07-19
modified: 2024-05-28
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.persistence
    - attack.defense-impairment
    - attack.t1548
    - attack.t1556
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message: Update conditional access policy
    condition: selection
falsepositives:
    - Misconfigured role permissions
    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    properties.message: Update conditional access policy

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`properties.message`	eq	`Update conditional access policy`	`field:"properties.message" kind:eq value:"Update conditional access policy"`