Elastic low stable kql

Microsoft Graph Request User Impersonation by Unusual Client

This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user.

View Source

Detection Logic

data_stream.dataset: "azure.graphactivitylogs"
    and event.type: "access"
    and azure.graphactivitylogs.properties.app_id: *
    and azure.graphactivitylogs.properties.c_idtyp: "user"
    and azure.graphactivitylogs.properties.client_auth_method: 0
    and http.response.status_code: 200
    and url.domain: "graph.microsoft.com"
    and not url.path: (
        /v1.0/organization
        or /v1.0/me/licenseDetails
        or /v1.0/me/photo*
        or /v1.0/me/photos*
        or /beta/me/settings/regionalAndLanguageSettings
        or /v1.0/me/drive/special/copilotuploads
        or /v1.0/me/informationProtection/sensitivityLabels
        or /beta/me/informationProtection/dataLossPreventionPolicies
    )

False Positives

⚠ Users legitimately accessing Microsoft Graph API using the specified client application ID and tenant ID. This may include authorized applications or services that interact with Microsoft Graph on behalf of users.
⚠ Authorized third-party applications or services that use the specified client application ID to access Microsoft Graph API resources for legitimate purposes.
⚠ Administrative or automated tasks that involve accessing Microsoft Graph API using the specified client application ID and tenant ID, such as provisioning or managing resources.

Field Validations

Loading…

Comments (0)

Loading comments...