KQL Search

Query Details

Audit Logs Software OATH Token Method Registered

Query

AuditLogs
    // | where LoggedByService == "Authentication Methods" and Category == "PolicyManagement" and AADOperationType == "ServiceApi"
    | where OperationName has "POST UserAuthMethod.SoftwareOathProofupRegistration"
    ),
    (
    AuditLogs
    // | where LoggedByService == "Core Directory" and Category == "UserManagement"
    // | where OperationName == "Update user"
    | where TargetResources has "StrongAuthenticationPhoneAppDetail"
    | mv-expand TargetResource = TargetResources
    | mv-expand modifiedProperty = TargetResource["modifiedProperties"]
    | where modifiedProperty["displayName"] == "StrongAuthenticationPhoneAppDetail"
    | mv-apply newValue = todynamic(tostring(modifiedProperty["newValue"])), oldValue = todynamic(tostring(modifiedProperty["oldValue"])) on (
        summarize
            NewValueBag = make_bag_if(bag_pack(tostring(newValue["Id"]), newValue), isnotempty(newValue)),
            OldValueBag = make_bag_if(bag_pack(tostring(oldValue["Id"]), oldValue), isnotempty(oldValue))
        | extend AddedAuthenticationMethod = bag_remove_keys(NewValueBag, bag_keys(OldValueBag))
        | where array_length(bag_keys(AddedAuthenticationMethod)) > 0
        )
    | mv-expand AddedAuthenticationMethod = todynamic(tostring(AddedAuthenticationMethod))
    | extend AddedAuthenticationMethod = AddedAuthenticationMethod[tostring(bag_keys(AddedAuthenticationMethod)[0])]
    | where AddedAuthenticationMethod["AuthenticationType"] == 2
        or tostring(AddedAuthenticationMethod["DeviceName"]) == "NO_DEVICE"
        or tostring(AddedAuthenticationMethod["DeviceToken"]) == "NO_DEVICE_TOKEN"
        or tostring(AddedAuthenticationMethod["PhoneAppVersion"]) == "NO_PHONE_APP_VERSION"
        or not(tostring(AddedAuthenticationMethod["HashFunction"]) in ("", "hmacsha256"))// or == "hmacsha1"
        or not(tolong(AddedAuthenticationMethod["NotificationType"]) in (2, 3, 4))
    )
| extend
    Initiator = iif(isnotempty(InitiatedBy["user"]), tostring(InitiatedBy["user"]["userPrincipalName"]), tostring(InitiatedBy["app"]["displayName"])),
    InitiatorId = iif(isnotempty(InitiatedBy["user"]), tostring(InitiatedBy["user"]["id"]), tostring(InitiatedBy["app"]["servicePrincipalId"])),
    IPAddress = tostring(InitiatedBy[tostring(bag_keys(InitiatedBy)[0])]["ipAddress"])
| project
    TimeGenerated,
    LoggedByService,
    Category,
    AADOperationType,
    Initiator,
    Identity,
    IPAddress,
    OperationName,
    Result,
    ResultDescription,
    AddedAuthenticationMethod,
    OldAuthenticationMethods = OldValueBag,
    AdditionalDetails,
    InitiatorId,
    InitiatedBy,
    TargetResources,
    CorrelationId

About this query

// Even if "Software OATH tokens" method is disabled, it might be possible to register it, generating an anomalous signal union (

Explanation

This KQL query is designed to detect potentially anomalous activities related to the registration of "Software OATH tokens" as an authentication method, even if this method is disabled. Here's a simplified breakdown of what the query does:

  1. Data Sources: The query pulls data from the AuditLogs table, focusing on two main scenarios:

    • Scenario 1: It looks for operations where the "Software OATH token" registration is attempted (POST UserAuthMethod.SoftwareOathProofupRegistration).
    • Scenario 2: It examines updates to user authentication methods, specifically changes to StrongAuthenticationPhoneAppDetail.

  2. Filtering and Expansion:

    • It filters logs to find changes related to StrongAuthenticationPhoneAppDetail.
    • It expands the details of these changes to identify any new authentication methods added.

  3. Anomalous Conditions: The query checks for specific conditions that might indicate an anomaly, such as:

    • The authentication type being set to a specific value (2).
    • Missing or default values for device-related fields (NO_DEVICE, NO_DEVICE_TOKEN, NO_PHONE_APP_VERSION).
    • Unusual hash functions or notification types.

  4. Result Construction: For each log entry that meets the criteria, the query extracts and projects relevant information, including:

    • The time the event was generated.
    • The service and category of the log.
    • Details about the initiator (user or app), including their ID and IP address.
    • The operation name and result.
    • Details about the added authentication method and any previous methods.
    • Additional context like correlation ID and target resources.

Overall, this query is designed to identify and provide detailed information about suspicious attempts to register or modify "Software OATH tokens" as an authentication method, which could indicate a security concern.