Elastic high stable eql

Entra ID Sign-in BloodHound Suite User-Agent Detected

Identifies potential enumeration activity using AzureHound, SharpHound, or BloodHound across Microsoft cloud services. These tools are often used by red teamers and adversaries to map users, groups, roles, applications, and access relationships within Microsoft Entra ID (Azure AD) and Microsoft 365.

View Source

Detection Logic

any where data_stream.dataset : (
    "azure.activitylogs",
    "azure.graphactivitylogs",
    "azure.auditlogs",
    "azure.signinlogs",
    "o365.audit"
) and user_agent.original regex~ "(azure
| sharp
| blood)(hound)/.*"

False Positives

⚠ Legitimate administrative or security assessment activities may use these user-agents, especially in environments where BloodHound is employed for authorized audits. If this is expected behavior, consider adjusting the rule or adding exceptions for specific user-agents or IP addresses.
⚠ Expected red team assessments or penetration tests may utilize BloodHound tools to evaluate the security posture of Azure or Microsoft 365 environments. If this is expected behavior, consider adjusting the rule or adding exceptions for specific IP addresses, registered applications, JWT tokens, PRTs or user principal names (UPNs).

Field Validations

Loading…

Comments (0)

Loading comments...