New Root Certificate Authority Added

Status: test
Severity: medium
Log source: product azure, service auditlogs
Author: Harjot Shah Singh, '@cyb3rjy0t'
Source: github.com/SigmaHQ/sigma

Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556` Modify Authentication Process
Defense Impairment	`T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Telemetry coverage

Platform	Record / event type
Azure	Set Company Information

Rules detecting the same action

These rules filter on the same operation.

[Entra ID] Domain Federation Trust Settings Modified (Kusto)
Azure AD New Custom Domain Added (Splunk)
Azure AD New Federated Domain Added (Splunk)
Azure Domain Federation Settings Modified (Sigma)
Entra ID Custom Domain Added or Verified (Elastic)
Entra ID Domain Federation Configuration Change (Elastic)
Modified domain federation trust settings (Kusto)
New onmicrosoft domain added to tenant (Kusto)

Rule body

title: New Root Certificate Authority Added
id: 4bb80281-3756-4ec8-a88e-523c5a6fda9e
status: test
description: Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
references:
    - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
    - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
author: Harjot Shah Singh, '@cyb3rjy0t'
date: 2024-03-26
tags:
    - attack.credential-access
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1556
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        OperationName: 'Set Company Information'
        TargetResources.modifiedProperties.newValue|contains: 'TrustedCAsForPasswordlessAuth'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    OperationName: 'Set Company Information'
    TargetResources.modifiedProperties.newValue|contains: 'TrustedCAsForPasswordlessAuth'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`OperationName`	eq	`Set Company Information`	`field:"OperationName" kind:eq value:"Set Company Information"`
`TargetResources.modifiedProperties.newValue`	match	`TrustedCAsForPasswordlessAuth`	`field:"TargetResources.modifiedProperties.newValue" kind:match value:"TrustedCAsForPasswordlessAuth"`