Upload File

agenda - sans institute...•pull from azure ad graph api •azure event hub •pre-built...

  • Home
  • Documents
  • Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •
30

Upload: others

Post on 20-May-2020

11 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •
Page 2: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Agenda

Password Spray

Page 3: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

One Friday afternoon

Colleague

Account Executive

Customer

Sunday

Customer

Page 4: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Password Spray

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

Newyear2020!Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Newyear2020!

Page 5: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

730,000+Compromised accounts due to password spray

(last 4 months)

Page 6: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

~100%Percentage of password spray attacks

from legacy protocols

Page 7: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Let’s agree on terminology

Basic Authentication

Legacy Authentication

Modern Authentication

Page 8: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Legacy Authentication, examples…

• POP, IMAP, SMTP, etc.

• Most mobile mail apps

Page 9: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Legacy Authentication, examples…

Mail clients that use Legacy Auth

Office 2010 and older

Office 2013 by default (can use modern auth with reg key)

Clients using older mail protocols

• POP, IMAP, SMTP, etc.

• Most mobile mail apps

Page 10: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Legacy Authentication, examples…

Mail clients that use Legacy Auth

Office 2010 and older

Office 2013 by default (can use Modern Auth with reg key)

Clients using older mail protocols

• POP, IMAP, SMTP, etc.

• Most mobile mail apps

Page 11: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Agenda

Finding Legacy Authentication

Page 12: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Finding Legacy Authentication In Azure AD

Page 13: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Finding Password Spray due to Legacy Authentication

in ADFS

ADFS Audit 411

Parsing script:

https://gallery.technet.microsoft.com/script

center/ADFS-Account-Lockout-and-

2d9a9a90

For 2016+, Audit 1203

Azure AD Connect Health Risky IP

Report

https://gallery.technet.microsoft.com/scriptcenter/ADFS-Account-Lockout-and-2d9a9a90
Page 14: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Azure AD + Azure Monitor =

Storing massive

amounts of

unstructured data

Big data streaming

platform and event

ingestion service

Collects telemetry

to retrieve and

analyze data

Store (JSON) Push to SIEM Analyze

Pull (JSON)

Page 15: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Azure AD + Azure Monitor =

Azure Sentinel

Page 16: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

• Pull from Azure AD Graph API

• Azure Event Hub• Pre-Built Integration into Azure Monitor, will PUSH events to SIEM

• Splunk (aka.ms/aad2splunk)

• Sumo Logic (aka.ms/aad2sumo)

• IBM QRadar (aka.ms/aad2QRadar)

• ArcSight (aka.ms/aad2Archsight)

• SysLog (aka.ms/aad2Syslog)

• Azure Log Analytics or Azure Sentinel

• https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory

Azure AD Logs into SIEM

https://splunkbase.splunk.com/app/3534/
https://help.sumologic.com/Send-Data/Applications-and-Other-Data-Sources/Azure-Audit/02Collect-Logs-for-Azure-Audit-from-Event-Hub
https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_microsoft_azure_overview.html?cp=SS42VS_7.3.0
https://community.softwaregrp.com/t5/Discussions/Announcing-General-Availability-of-ArcSight-Smart-Connectors-7/m-p/1671852
https://github.com/miguelangelopereira/azuremonitor2syslog/
https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory
Page 17: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Azure Log Analytics Workbooks

Legacy Auth

Page 18: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Azure Log Analytics Workbooks – Edit Mode

Page 19: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Azure Sentinel Workbooks

Page 20: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Agenda

Blocking Legacy Authentication

Page 21: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Identity Protection

Role Based Access Control

Core Store

Azure Active DirectoryAuthentication

Services

Office 365

Conditional Access Engine

Legacy Authentication

Client

Microsoft Cloud Services

Client Network

IDP

On-premises

DC

******

U/P App Cache

Conditional Access Policies

Exchange Online

AD FS

Azure AD

Key

Authentication flows

Authorisation flows

App-Specific traffic

Stop!

Mailbox Auth Lockdown

Authentication Policies

Client IP Block

Extranet Soft Lockout

Extranet Smart Lockout

AD FS AuthZ rules

Page 22: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Blocking Legacy Auth in Exchange

https://docs.microsoft.com/en-

us/powershell/module/exchange/client-access/set-

casmailbox?view=exchange-ps

https://docs.microsoft.com/en-us/exchange/clients-and-

mobile-in-exchange-online/disable-basic-authentication-

in-exchange-online

https://docs.microsoft.com/en-

us/powershell/module/exchange/organization/set-

organizationconfig?view=exchange-ps

https://docs.microsoft.com/en-us/powershell/module/exchange/client-access/set-casmailbox?view=exchange-ps
https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online
https://docs.microsoft.com/en-us/powershell/module/exchange/organization/set-organizationconfig?view=exchange-ps
Page 23: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

ADFS Extranet and Smart Lockout

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-smart-

lockout-protection

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-soft-lockout-

protection

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-smart-lockout-protection
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-soft-lockout-protection
Page 24: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Blocking Authorisation in ADFS / Federation Provider

https://docs.microsoft.com/en-us/windows-

server/identity/ad-fs/operations/access-control-

policies-w2k12

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/access-control-policies-w2k12
Page 25: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Blocking Legacy Authentication in Azure AD

• Block today with Conditional Access

• Only Service Accounts / apps

should remain• Ring-fence and protect

• Report Only mode

https://docs.microsoft.com/en-us/azure/active-

directory/conditional-access/concept-conditional-access-

report-only

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-report-only
Page 26: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Agenda

Go Do’s!

Page 27: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Go Dos!

Enable MFA / Go Passwordless / Device Trust

https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing

Smart Lockout https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-smart-

lockout-protection

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-mailbag-discovering-and-

blocking-legacy-authentication/ba-p/369725

https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-smart-lockout-protection
https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-mailbag-discovering-and-blocking-legacy-authentication/ba-p/369725
Page 28: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Go Dos!

Ask for forgiveness, not permission

https://aka.ms/passwordguidance

Deploy Azure AD Password Protection to on premises

https://aka.ms/deploypasswordprotection

https://docs.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity

https://aka.ms/passwordguidance
https://docs.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity
Page 29: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

Bonus Content: I’ve been Legacy Auth’ed! Help me!

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance

https://blogs.technet.microsoft.com/office365security/finding-illicit-activity-the-old-fashioned-way/

Best practices for defending against password spray attacks

https://www.microsoft.com/en-us/microsoft-365/blog/2018/03/05/azure-ad-and-adfs-best-practices-defending-

against-password-spray-attacks/

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance
https://blogs.technet.microsoft.com/office365security/finding-illicit-activity-the-old-fashioned-way/
https://www.microsoft.com/en-us/microsoft-365/blog/2018/03/05/azure-ad-and-adfs-best-practices-defending-against-password-spray-attacks/
Page 30: Agenda - SANS Institute...•Pull from Azure AD Graph API •Azure Event Hub •Pre-Built Integration into Azure Monitor, will PUSH events to SIEM • Splunk (aka.ms/aad2splunk) •

[email protected]

[email protected]

mailto:[email protected]
mailto:[email protected]

Splunk Inc. Splunk 4.1.7 Security Target - Common Criteria · 1.1 ST Reference ... 7.1.3.2 FDP_ACF.1 Access control functions ... ST Title: Splunk Inc. Splunk 4.1.7 Security Target

Netfilter Iptables for Splunk Documentation - Read … · Netfilter Iptables for Splunk Documentation, Release 0 Splunk Answers Splunk has a strong community of active users and

Splunk .conf2011: Splunk for Fraud and Forensics at Intuit

Islands*of*Splunk* - .conf2017 | The 8th Annual Splunk ... · Background*! Splunk*administrators*are*increasingly*required*to*provision*Splunk* as*aservice*offering*to*mulJple*customers*

Fortscale Splunk Integrationinfo.fortscale.com/hubfs/UEBA Content/Fortscale Splunk Integration.pdf · Fortscale Splunk Integration ... Fortscale digests access and authentication

Splunk Spark Integration - GitHub Pageslitaotao.github.io/files/4. splunk_spark.pdf · Splunk Spark Integration ... • Splunk"products:""! Splunk"Enterprise"! ... splunk_spark Created

Table of contents - Smart School · Azure DevOps Engineer Azure Fundamentals Azure Solution Architect Azure training & certifications (Optional) Optional Path Required Path aka.ms/DataAIExams

Splunk For IT Operational Intelligence · • Splunk Apps –Splunk App for VMware –Splunk Apps for Citrix & Hyper V –Splunk App for Microsoft Exchange –Splunk App for Active

Grigori Melnik, Fernando Simonazzi Microsoft patterns & practices patterns & practices symposium 2013 Autoscaling in Windows Azure aka.ms/autoscaling

Get inspired aka.ms/mixgallery Do more with Office Mix

データ分析プラットフォーム「Splunk」 - Panasonicdl.it-sol.jpn.panasonic.com/data/splunk/splunk.pdfTitle データ分析プラットフォーム「Splunk」 Author パナソニック

Azure Event Hub Connector User Guide - SOLSYS · 2019-07-31 · 3- Install Azure Event Hub Connector on Splunk Heavy Forwarder 4- Configure Azure Event Hub TA on Heavy Forwarder 5-

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Splunk Conf2010: Corporate Express presents Splunk with SAP

Splunk conf2014 - Splunk for Data Science

Azure Architecture Center (aka.ms/mspnp) · Azure Architecture Center (aka.ms/mspnp) 3 Decision tree for Azure compute $]X U H% D WFK services $]X U H) XQFWLRQV &RQWDLQHU,QVWDQFHV

Program Overview - Splunk...mission-critical services. None. Splunk Enterprise System Administration Splunk Enterprise Data Administration Splunk Cloud Administration Implementing

Presented by In Partnership with - Smithsonian · Download the trial at aka.ms/beginhere Join our community at aka.ms/joinus Learn to Play via our Tutorial at aka.ms/learntoplay Start

SPLUNK® ENTERPRISE - CDWwebobjects.cdw.com/.../Splunk/Product-Brief-Splunk-Enterprise-The... · Splunk Enterprise collects data from any source, including logs, clickstreams, sensors,

Splunk Developer & Admin Certification Training...This Splunk course also includes various topics of Splunk, such as installation and configuration, Splunk Syslog, Syslog Server, log

Referent / Redner Benjamin Tiggemann · 2015-07-08 · Splunk for Exchange Splunk for Enterprise Security* Splunk for Vmware Splunk for PCI Compliance* Splunk for Windows Splunk for

Splunk App for StreamMany Solutions, One Goal. Some history •Splunk acquires Cloudmeter, December 2013 •Renamed Splunk App for Stream •Released with Splunk 6.0 (August, 2014)

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Splunk conf2014 - Onboarding Data Into Splunk

FireEye Splunk InterFireEye + Splunk: Intermediate Guidemediate Guide

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Splunk Cloud Product Briefwinncom.com.ua/wp-content/uploads/2018/07/splunk-Log_Flow.pdf · Extend Benefits With Splunk Apps Splunk Cloud includes support for premium solutions such

Deploying*Splunk*Enterprise*On** Microso=*Azure*IaaS* Splunk*Azure*Deployment@Microso=*Office* Provisioning&&&AutomaNon& Azure*BestPracCces* Splunk*&*Azure*Integraons* 49 Provisioning*&*Automaon*

Azure Architecture Center (aka.ms/mspnp) Application... · Kubernetes Marathon Swarm Service Fabric Request Repository Validation Cluster state store Etcd Consul Zookeeper Service

Http://aka.ms/FEEAB

Splunk user group - automating Splunk with Ansible

CMK: WHAT ARCHITECTS NEED TO KNOW€¦ · Gemalto AWS Azure CloudTrail Splunk LogRhythm Web Browser (Admin) SaaS Provider Infrastructure KMS SIEM SDK

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Time*ACer*Time*–** Comparing*Time*Ranges*in*Splunk* · AboutMe*! Splunk*Senior*Instructor*since*2009*! Frequentcontributor*to*Splunk*Answers*! Love*Splunk*search*language*puzzles*

Monitoring Docker Containers with Splunk - Splunk .conf · Splunk and Docker – At A Glance Visibility in your Container Environments Delivering Splunk as Containers Monitoring for