Repository navigation
Conversation
|
💚 CLA has been signed |
b135fbd to
1a57aa0
Compare
|
@earbona23 -> thanks for the rule recommendations. I went and reviewed existing coverage, this was indeed a solid addition. Emulation/research from our end suggests a more broader approach to this rule -> any end-user based application consent for high-risk delegated scopes (commonly seen abused or targeted in-the-wild). The scopes can be adjusted by us/customers over time if needed, but cast a broader net. There is also a balance between first-party & 3rd party FPs and FNs to be considered here. Some additional logic was added to take these into consideration. Added you as an author still. Please feel free to close this and we can resume in the other. -> #6944 |
…legated Scopes (elastic#6944) * [New Rule] Entra ID End-User Consent to Application with High-Risk Delegated Scopes Builds on elastic#6729 (Eduard Arbona): broadens scope coverage beyond mailbox, adds first-party/in-tenant/external app owner classification, handles per-resource consent events, and keeps the query fully row-level. * Revise metadata and risk assessment parameters Updated creation date, risk score, and severity level. Modified alert suppression strategy and added new tags. * Add Rule Type for ESQL in Azure integration Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Shorten description; suppress on user + service principal id * Revert suppression to user level; keep shortened description * Update rules/integrations/azure/initial_access_entra_id_end_user_consent_high_risk_scopes.toml Co-authored-by: Bryan Porras <bryan.porras@elastic.co> * Update rules/integrations/azure/initial_access_entra_id_end_user_consent_high_risk_scopes.toml Co-authored-by: Bryan Porras <bryan.porras@elastic.co> * Update rules/integrations/azure/initial_access_entra_id_end_user_consent_high_risk_scopes.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Bryan Porras <bryan.porras@elastic.co> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
|
#6944 is the better shape. A tunable scope list beats the fixed mailbox plus offline_access pair I started from, and the first-party versus third-party FP balance was the part I had no good data on. Happy for this one to be closed in favour of it. Thanks for keeping the authorship. |
2 participants
ES|QL rule over logs-azure.auditlogs-* (T1528). Deterministic scope-combination detection: non-admin consent to a third-party app requesting a high-risk mailbox scope together with offline_access. Complementary to the existing new-terms 'Illicit Consent Grant via Registered Application'. Passes:
python -m detection_rules validate-rule.