Detecting Potential CA Policy Bypass By Privileged Accounts Via Private Browser Sessions
Query
DeviceProcessEvents
|where isnotempty(AccountUpn) and FileName in~ ("chrome.exe","msedge.exe","firefox.exe")
| extend Navigation_Mode= iif(ProcessCommandLine has_any("--incognito","--inprivate","-private","-private-window"),"๐จPrivate","Normal")
| join kind=inner (IdentityInfo) on $left.AccountUpn == $right.AccountUpn
| summarize Navigation_Mode=make_set(Navigation_Mode),make_set(AccountUpn),Distinct_Upn=dcount(AccountUpn),AssignedRoles=make_set(AssignedRoles),Potential_Case=dcount(Navigation_Mode) by DeviceName
| where Potential_Case > 1 and Distinct_Upn > 1 and (tostring(AssignedRoles) != "[]")
//| where tostring(AssignedRoles) contains "admin"About this query
Explanation
This KQL query is designed to detect potential security risks involving privileged accounts in a cloud environment. Here's a simplified explanation:
-
Context: The query addresses a security concern where two accounts from the same organization (Entra tenant) are signed into the same browser. The primary account's device authentication can be unintentionally applied to the second account, potentially bypassing security checks meant for specific devices.
-
Objective: The query aims to identify when privileged accounts (or any accounts) are signing in using private or incognito browser sessions on a device where another account might already be signed in. This behavior could indicate an attempt to bypass security policies.
-
How it Works:
- It looks for browser processes (
chrome.exe,msedge.exe,firefox.exe) that are running in private or incognito mode. - It checks if these processes are associated with accounts that have been assigned specific roles.
- It identifies devices where multiple accounts are signed in and where private browsing is used, which could indicate a security risk.
- It looks for browser processes (
-
Customization: The query can be adjusted to focus specifically on admin roles by uncommenting the line that filters for roles containing "admin".
In summary, this query helps detect scenarios where private browsing might be used to circumvent security measures for privileged accounts, potentially exposing the organization to security threats.
