KQL Search

Query Details

HomeAI ToolsDevice Query

Threat Hunting Azure Hound Usage

Query

// Threat Hunting AzureHound Usage

// Tool Profile: AzureHound framework
// Link: https://security.microsoft.com/threatanalytics3/ec964e9b-f365-4dc3-b5b4-44f1532198b5/
// The DefenderXDR portal has just released a Threat Analytics Report on the AzureHound Framework. AzureHound, part of the BloodHoundAD project on GitHub, is the official tool for collecting Azure data for BloodHound and BloodHound Enterprise. This command-line tool, which can be built from source, is utilized for both offensive and defensive security testing. The report includes two advanced hunting queries focused on AzureHound cmdlets and reconnaissance activities using network logs. Additionally, I have contributed another KQL query to GitHub for detecting AzureHound usage, which is not included in the Threat Analytics Report.

MicrosoftGraphActivityLogs
| where TimeGenerated > ago(90d)
| where UserAgent has "azurehound"
| extend ObjectID = iff(isempty(UserId), ServicePrincipalId, UserId)
| join kind=leftouter IdentityInfo on $left.ObjectID == $right.AccountObjectId
| where isnotempty(AccountUPN)
| project-reorder TimeGenerated, AppId, IPAddress, AccountUPN, AccountCreationTime, AssignedRoles, ServicePrincipalId, RequestId, RequestMethod, ResponseStatusCode, RequestUri, ResponseSizeBytes, Roles

// MITRE ATT&CK Mapping

// T1078 - Valid Accounts: The query filters logs based on user agents and identity information, which can help identify the use of valid accounts.
// T1087 - Account Discovery: By joining with identity information and filtering based on AccountUPN, the query can help in discovering accounts.
// T1071 - Application Layer Protocol: The RequestUri and RequestMethod fields can be used to analyze communication patterns, which is relevant to application layer protocols.
// T1040 - Network Sniffing: The IPAddress field can be used to detect network sniffing activities.
// T1057 - Process Discovery: The UserAgent field can help identify processes or tools used, such as “azurehound”.

Explanation

This KQL query is designed for threat hunting to detect the usage of the AzureHound tool, which is part of the BloodHoundAD project used for security testing in Azure environments. Here's a simplified summary:

  1. Data Source: The query looks at logs from MicrosoftGraphActivityLogs over the past 90 days.
  2. Filter: It filters these logs to find entries where the UserAgent contains "azurehound", indicating the use of the AzureHound tool.
  3. Identity Matching: It extends the logs to include an ObjectID based on whether the UserId or ServicePrincipalId is present.
  4. Join with Identity Info: The query joins this data with IdentityInfo to get more details about the accounts involved.
  5. Filter Non-Empty Accounts: It further filters to ensure that only logs with non-empty AccountUPN (User Principal Name) are considered.
  6. Select Fields: Finally, it selects and reorders specific fields like TimeGenerated, AppId, IPAddress, AccountUPN, and others for detailed analysis.

MITRE ATT&CK Mapping:

  • T1078 - Valid Accounts: Helps identify the use of valid accounts by filtering based on user agents and identity information.
  • T1087 - Account Discovery: Assists in discovering accounts by joining with identity information and filtering based on AccountUPN.
  • T1071 - Application Layer Protocol: Analyzes communication patterns using RequestUri and RequestMethod.
  • T1040 - Network Sniffing: Detects network sniffing activities using the IPAddress field.
  • T1057 - Process Discovery: Identifies processes or tools used, such as "azurehound", through the UserAgent field.

In essence, this query helps security analysts detect and analyze the use of the AzureHound tool within their Azure environment, providing insights into potential security threats and activities.

Details

Steven Lim profile picture

Steven Lim

Released: September 7, 2024

Tables

MicrosoftGraphActivityLogs IdentityInfo

Keywords

MicrosoftGraphActivityLogsUserAgentObjectIDUserIdServicePrincipalIdIdentityInfoAccountObjectIdAccountUPNAppIdIPAddressAccountCreationTimeAssignedRolesRequestIdRequestMethodResponseStatusCodeRequestUriResponseSizeBytesRoles

Operators

agohasiffisemptyjoinkindleftouteron==isnotemptyproject-reorder

Actions