LAB 20: ReliaQuest GreyMatter & Entra ID

Prerequisites for Integration: RELIAQUEST REQUIREMENTS: ✓ Active ReliaQuest GreyMatter subscription ✓ GreyMatter Admin or Integration Manager role ✓ Network connectivity to Microsoft Graph API MICROSOFT REQUIREMENTS: ✓ Microsoft Entra ID P1/P2 license ✓ Global Administrator or Application Administrator role ✓ Permissions to create App Registrations DATA TO INGEST: SigninLogs (user authentications) AuditLogs (directory changes) RiskyUsers (Identity Protection) RiskDetections (risk events) ProvisioningLogs (user provisioning) ServicePrincipalSignInLogs (app auth) ESTIMATED LOG VOLUME: - Small org (500 users): ~1-5 GB/day - Medium org (5000 users): ~10-50 GB/day - Large org (50000+ users): ~100+ GB/day Plan retention and storage accordingly.

Navigate to: entra.microsoft.com App registrations New registration APPLICATION DETAILS: - Name: ReliaQuest-GreyMatter-Integration - Supported account types: Single tenant - Redirect URI: (leave blank for now) Register RECORD THESE VALUES: - Application (client) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx - Directory (tenant) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx CREATE CLIENT SECRET: Certificates & secrets New client secret - Description: GreyMatter API Access - Expires: 24 months (set calendar reminder!) Add COPY SECRET VALUE IMMEDIATELY - Only shown once! - Store securely (vault, password manager) Record: Client Secret Value: xxxxxxxxxxxxxxxxxxxxxxxxxx

Navigate to: App registration API permissions Add a permission Microsoft Graph APPLICATION PERMISSIONS (for data ingestion): READ PERMISSIONS: ✓ AuditLog.Read.All - Read all audit log data ✓ Directory.Read.All - Read directory data (users, groups) ✓ IdentityRiskEvent.Read.All - Read identity risk event info ✓ IdentityRiskyUser.Read.All - Read risky user info ✓ Policy.Read.All - Read Conditional Access policies ✓ Reports.Read.All - Read all reports (sign-in logs) ✓ User.Read.All - Read all users' full profiles RESPONSE ACTION PERMISSIONS (for automated response): ✓ User.ReadWrite.All - Update user properties (disable accounts) ✓ User.RevokeSessions.All - Revoke user sign-in sessions Add permissions GRANT ADMIN CONSENT: Grant admin consent for [Tenant Name] Confirm "Yes" Verify: All permissions show ✓ green checkmark

Navigate to: GreyMatter Settings Data Sources Add Data Source Microsoft Entra ID (Azure AD) CONNECTION CONFIGURATION: Authentication: - Tenant ID: [Your Directory/Tenant ID] - Client ID: [Application/Client ID] - Client Secret: [Secret Value] Data Collection Options: ☑ Sign-in Logs ☑ Audit Logs ☑ Risky Users ☑ Risk Detections ☑ Provisioning Logs ☑ Service Principal Sign-ins Collection Interval: - Real-time (recommended): Events streamed - Polling: Every 5 minutes Historical Data: - Import last: 30 days (or as needed) - Note: May take hours for large tenants Test Connection - Should show "Connection Successful" - Verify each log type shows data Save & Enable

Verify Data is Flowing: Navigate to: GreyMatter Search/Investigate QUERY ENTRA ID DATA: Search for Sign-in Events: source:entra_signin_logs | where timestamp > now() - 1h | limit 100 Search for Audit Events: source:entra_audit_logs | where timestamp > now() - 1h | limit 100 Search for Risk Events: source:entra_risk_detections | where timestamp > now() - 7d | limit 100 VERIFY DATA FIELDS: Sign-in Logs should include: - userPrincipalName - ipAddress - location - appDisplayName - resultType (success/failure code) - conditionalAccessStatus - mfaDetail Audit Logs should include: - activityDisplayName - initiatedBy - targetResources - result CHECK DATA SOURCE HEALTH: Settings Data Sources Entra ID - Status: Active - Last event received: [recent timestamp] - Events/hour: [count]

# Microsoft Graph API Endpoints for Identity Security # Base URL https://graph.microsoft.com/v1.0/ # SIGN-IN LOGS GET /auditLogs/signIns GET /auditLogs/signIns?$filter=createdDateTime ge {datetime} GET /auditLogs/signIns?$filter=userPrincipalName eq 'user@domain.com' # AUDIT LOGS GET /auditLogs/directoryAudits GET /auditLogs/directoryAudits?$filter=activityDisplayName eq 'Add member to role' # RISKY USERS GET /identityProtection/riskyUsers GET /identityProtection/riskyUsers?$filter=riskLevel eq 'high' GET /identityProtection/riskyUsers/{id} # RISK DETECTIONS GET /identityProtection/riskDetections GET /identityProtection/riskDetections?$filter=riskEventType eq 'impossibleTravel' # USER DETAILS (Enrichment) GET /users/{id} GET /users/{id}?$select=displayName,jobTitle,department,manager GET /users/{id}/memberOf # USER MANAGEMENT (Response Actions) PATCH /users/{id} # Disable user POST /users/{id}/revokeSignInSessions POST /users/{id}/authentication/methods # Reset MFA

Navigate to: GreyMatter Settings Response Actions Add Response Connector Microsoft Entra ID CONNECTOR CONFIGURATION: Name: EntraID-Response-Actions Type: Microsoft Entra ID / Azure AD Authentication: - Use existing data source credentials: Yes (Or configure separate app with write permissions) Available Actions: ☑ Disable User Account ☑ Enable User Account ☑ Revoke User Sessions ☑ Reset User Password ☑ Require MFA Re-registration ☑ Dismiss User Risk ☑ Confirm User Compromised ☑ Block Sign-in Action Permissions Required: - User.ReadWrite.All (disable/enable) - User.RevokeSessions.All (revoke sessions) - UserAuthenticationMethod.ReadWrite.All (reset MFA) - IdentityRiskyUser.ReadWrite.All (risk actions) Test Actions (use test account) Save & Enable

Navigate to: GreyMatter Settings Entity Enrichment Configure Microsoft Entra ID USER ENRICHMENT: When a user entity is encountered: ☑ Auto-enrich from Entra ID Enrichment Fields: ☑ Display Name ☑ Job Title ☑ Department ☑ Manager ☑ Office Location ☑ Account Enabled Status ☑ Last Sign-in Date ☑ Risk Level (Identity Protection) ☑ Risk State ☑ Group Memberships ☑ Assigned Roles ☑ MFA Registration Status Enrichment Trigger: On alert creation On investigation start Manual only Cache Duration: 4 hours (Balance freshness vs API calls) Save Configuration

Microsoft Graph API Throttling Limits: GENERAL LIMITS: - 10,000 requests per 10 minutes per app - Specific endpoints may have lower limits SIGN-IN LOGS: - 1,000 records per request - Use $top and pagination - Filter by time to reduce volume OPTIMIZATION STRATEGIES: 1. USE DELTA QUERIES: GET /auditLogs/signIns/delta - Only returns changes since last query - Significantly reduces API calls 2. BATCH REQUESTS: POST /$batch - Combine multiple requests - Up to 20 requests per batch 3. SELECT SPECIFIC FIELDS: GET /users/{id}?$select=displayName,department - Reduce payload size - Faster responses 4. IMPLEMENT CACHING: - Cache user details for 4-24 hours - Cache group memberships - Refresh on investigation start 5. HANDLE THROTTLING: - Watch for 429 responses - Implement exponential backoff - Use Retry-After header GREYMATTER SETTINGS: Data Source Advanced - Request rate: 100/minute (safe default) - Retry on throttle: Yes - Backoff multiplier: 2x

GreyMatter Detection Rule Structure: RULE COMPONENTS: 1. METADATA - Name: Descriptive title - Description: What it detects and why - Severity: Critical/High/Medium/Low - MITRE ATT&CK: Mapping to techniques - Tags: Identity, Azure, Brute Force, etc. 2. DATA SOURCE - Source: entra_signin_logs, entra_audit_logs - Time window: 5m, 15m, 1h, 24h 3. DETECTION LOGIC - Query/filter conditions - Aggregations and thresholds - Correlation with other events 4. ENTITY MAPPING - User: userPrincipalName - IP: ipAddress - Device: deviceId - Application: appId 5. RESPONSE ACTIONS - Auto-enrichment - Notification - Automated containment RULE TYPES: - Threshold: X events in Y time - Anomaly: Deviation from baseline - Correlation: Multiple conditions - Sequence: Events in specific order

# Navigate to: GreyMatter Detection Rules Create # RULE: Brute Force Attack - Multiple Failed Logins # Metadata Name: EntraID - Brute Force Attack Detected Description: Multiple failed sign-in attempts followed by success Severity: High MITRE: T1110 - Brute Force # Query (GreyMatter Query Language) source:entra_signin_logs | where resultType != "0" // Failed attempts | stats failed_count = count(), unique_ips = dc(ipAddress), apps = values(appDisplayName) by userPrincipalName, bin(timestamp, 15m) | where failed_count > 10 # Then check for success | join type=inner ( source:entra_signin_logs | where resultType == "0" | where timestamp > now() - 15m ) on userPrincipalName | where success_timestamp > failure_window_end # Alert Configuration Threshold: 1 match Suppression: 1 hour per user Auto-enrichment: Yes # Entity Mapping User: userPrincipalName IP: ipAddress # Response Actions - Enrich user from Entra ID - Create incident - Notify SOC channel

# RULE: Impossible Travel - Geographically Distant Sign-ins # Metadata Name: EntraID - Impossible Travel Detected Description: User signed in from distant locations in short time Severity: High MITRE: T1078 - Valid Accounts # Query source:entra_signin_logs | where resultType == "0" // Successful only | sort userPrincipalName, timestamp asc | streamstats prev_location = last(location), prev_timestamp = last(timestamp), prev_ip = last(ipAddress) by userPrincipalName | eval time_diff_hours = (timestamp - prev_timestamp) / 3600 | eval distance_km = haversine( location.latitude, location.longitude, prev_location.latitude, prev_location.longitude ) | eval required_hours = distance_km / 900 // ~900 km/h flight speed | where time_diff_hours < required_hours | where distance_km > 500 // Minimum 500km # Alert Configuration Threshold: 1 match Severity: High (if distance > 5000km), Medium otherwise # Entity Mapping User: userPrincipalName IP: ipAddress, prev_ip Location: location, prev_location # Exclusions - Known VPN exit locations - Users with travel flag enabled

# RULE: Privileged Role Assignment Outside PIM # Metadata Name: EntraID - Direct Privileged Role Assignment Description: Admin role assigned directly, bypassing PIM Severity: Critical MITRE: T1098 - Account Manipulation # Query source:entra_audit_logs | where activityDisplayName == "Add member to role" | where NOT activityDisplayName CONTAINS "PIM" | eval role_name = targetResources[0].modifiedProperties.Role.newValue | where role_name IN ( "Global Administrator", "Privileged Role Administrator", "Privileged Authentication Administrator", "Security Administrator", "Exchange Administrator", "SharePoint Administrator", "User Administrator" ) | eval assigned_user = targetResources[0].userPrincipalName | eval assigned_by = initiatedBy.user.userPrincipalName # Alert Configuration Threshold: 1 match Severity: Critical for Global Admin, High for others Suppression: None (always alert) # Entity Mapping User (target): assigned_user User (actor): assigned_by Role: role_name # Response Actions - Immediate SOC notification - Enrich both users - Consider auto-remediation

GreyMatter User Entity Page: Navigate to: Investigation Entity Search Search user: compromised.user@contoso.com USER OVERVIEW: Display Name: John Doe Job Title: Financial Analyst Department: Finance Manager: Jane Smith Account Status: Enabled Risk Level: High (from Identity Protection) Last Sign-in: 2024-01-15 14:32:00 MFA Registered: Yes (Authenticator App) INVESTIGATION TABS: 1. TIMELINE - All events chronologically - Sign-ins, audit events, alerts - Filter by time range - Highlight anomalies 2. SIGN-IN ACTIVITY - Recent sign-ins (success/failure) - Locations and IPs - Applications accessed - Device information 3. DIRECTORY CHANGES - Group membership changes - Role assignments - Password resets - MFA changes 4. RISK EVENTS - Identity Protection detections - Leaked credentials - Impossible travel - Anonymous IP usage 5. RELATED ENTITIES - Associated IPs - Devices used - Applications accessed - Related users (same IP/device)

# Investigation Query Templates # All activity for compromised user (last 7 days) source:entra_* | where userPrincipalName == "user@contoso.com" OR initiatedBy.user.userPrincipalName == "user@contoso.com" | where timestamp > now() - 7d | sort timestamp desc # All users from suspicious IP source:entra_signin_logs | where ipAddress == "203.0.113.50" | where timestamp > now() - 30d | stats first_seen = min(timestamp), last_seen = max(timestamp), signin_count = count() by userPrincipalName | sort signin_count desc # Changes made by compromised account source:entra_audit_logs | where initiatedBy.user.userPrincipalName == "user@contoso.com" | where timestamp > now() - 7d | table timestamp, activityDisplayName, targetResources # Applications accessed during compromise window source:entra_signin_logs | where userPrincipalName == "user@contoso.com" | where timestamp BETWEEN "2024-01-14" AND "2024-01-15" | where resultType == "0" | stats count by appDisplayName | sort count desc # Check for persistence mechanisms source:entra_audit_logs | where timestamp > now() - 7d | where activityDisplayName IN ( "Add service principal credentials", "Consent to application", "Add app role assignment", "Add member to role" ) | where initiatedBy.user.userPrincipalName == "user@contoso.com"

Identity Compromise Investigation Checklist: INITIAL TRIAGE: ☐ Confirm alert is true positive ☐ Identify affected user(s) ☐ Determine compromise timeline ☐ Assess current risk level SCOPE DETERMINATION: ☐ How did attacker gain access? - Phishing? Credential stuffing? Token theft? ☐ What systems were accessed? ☐ Was data exfiltrated? ☐ Are other accounts affected? ☐ Is lateral movement evident? PERSISTENCE CHECK: ☐ New OAuth applications consented? ☐ New service principal credentials? ☐ New MFA devices registered? ☐ Mail forwarding rules created? ☐ Admin roles assigned? ☐ Inbox rules for credential harvesting? TIMELINE RECONSTRUCTION: ☐ First malicious sign-in ☐ Initial access vector ☐ Post-compromise activities ☐ Data access/exfiltration ☐ Persistence establishment ☐ Last known malicious activity EVIDENCE COLLECTION: ☐ Export relevant logs ☐ Screenshot key findings ☐ Document IOCs (IPs, user agents) ☐ Preserve audit trail

# Correlate Entra ID with other data sources # Find endpoint activity for compromised user source:endpoint_logs OR source:entra_signin_logs | where user == "john.doe" OR userPrincipalName == "john.doe@contoso.com" | where timestamp > now() - 24h | sort timestamp | table timestamp, source, event_type, details # Correlate sign-in with email threats source:entra_signin_logs | where userPrincipalName == "user@contoso.com" | where timestamp > now() - 1h | join type=inner ( source:email_security_logs | where recipient == "user@contoso.com" | where verdict == "phishing" | where timestamp > now() - 24h ) on timestamp WITHIN 1h # Find other users from same attack campaign source:entra_signin_logs | where ipAddress IN ( SELECT ipAddress FROM entra_signin_logs WHERE userPrincipalName == "compromised@contoso.com" AND resultType != "0" ) | where userPrincipalName != "compromised@contoso.com" | stats count by userPrincipalName, resultType # Timeline across all sources source:* | where user == "john.doe" OR userPrincipalName CONTAINS "john.doe" OR email == "john.doe@contoso.com" | where timestamp BETWEEN "2024-01-14T00:00:00" AND "2024-01-15T23:59:59" | sort timestamp | table timestamp, source, event_type

Available Entra ID Response Actions: CONTAINMENT ACTIONS: Disable User Account - Immediately blocks all sign-ins - Existing sessions remain valid Revoke User Sessions - Invalidates all refresh tokens - Forces re-authentication - Use WITH disable for full containment Block Sign-in (Account Enabled = false) - Same as disable user Require Password Change - User must change password at next sign-in RISK MANAGEMENT: Confirm User Compromised - Sets risk level to High - Triggers risk-based CA policies Dismiss User Risk - Clears risk state - Use after remediation complete Reset User Risk - Returns to normal state MFA ACTIONS: Require MFA Re-registration - Clears existing MFA methods - User must re-register Remove Specific MFA Method - Remove compromised device REMEDIATION: Remove Role Assignments Remove Group Memberships Revoke OAuth App Consent Remove Service Principal Credentials

Navigate to: GreyMatter Automation Playbooks Create Playbook PLAYBOOK: Auto-Contain Compromised User TRIGGER: - Alert: High/Critical severity - Rule: Any identity compromise rule - Conditions: Risk score > 80 STEPS: 1. ENRICH USER Action: Entra ID - Get User Details Input: Alert.userPrincipalName Output: user_details 2. CHECK IF VIP Condition: user_details.department IN ("Executive", "IT Security") If True: Route to manual review If False: Continue automation 3. DISABLE USER Action: Entra ID - Disable User Account Input: Alert.userPrincipalName 4. REVOKE SESSIONS Action: Entra ID - Revoke Sign-in Sessions Input: Alert.userPrincipalName 5. CONFIRM COMPROMISED Action: Entra ID - Confirm User Compromised Input: Alert.userPrincipalName 6. NOTIFY SOC Action: Send to Slack/Teams Message: " User {user} auto-contained due to {alert_name}" 7. CREATE TICKET Action: Create ServiceNow Incident Priority: High Assignment: Identity Security Team 8. UPDATE ALERT Action: Add note to alert Note: "Automated containment executed at {timestamp}"

# PLAYBOOK: Block Malicious IP via Named Locations TRIGGER: - Alert: Password spray, brute force - Threshold: Same IP targeting >10 users STEPS: 1. EXTRACT IP Action: Parse alert entities Output: malicious_ip 2. CHECK IP REPUTATION Action: Query threat intelligence Input: malicious_ip Output: ip_reputation 3. VALIDATE NOT CORPORATE Condition: malicious_ip NOT IN corporate_ip_ranges If corporate: Route to manual review 4. ADD TO BLOCK LIST (Graph API) Action: HTTP Request Method: PATCH URL: https://graph.microsoft.com/v1.0/identity/conditionalAccess/namedLocations/{blocked-ips-id} Body: { "ipRanges": [ {"cidrAddress": "{malicious_ip}/32"} ] } 5. VERIFY BLOCK Action: Entra ID - Test sign-in from IP Expected: Blocked by Conditional Access 6. LOG ACTION Action: Add to block list audit log Details: IP, reason, timestamp, alert_id 7. NOTIFY Action: Send notification Message: "IP {malicious_ip} added to Entra ID block list" NOTE: Requires pre-configured Named Location used in Conditional Access policy to block

# PLAYBOOK: Remove Malicious OAuth Application TRIGGER: - Alert: Suspicious OAuth consent detected - Conditions: - New application with Mail.Read or Files.ReadWrite - Application not in approved list STEPS: 1. EXTRACT APP DETAILS Action: Parse alert Output: app_id, app_name, user_principal_name 2. CHECK APPROVED LIST Condition: app_id IN approved_applications If approved: Close alert as false positive If not: Continue 3. GET CONSENT DETAILS Action: Graph API - Get OAuth2PermissionGrants Filter: clientId eq '{app_id}' Output: consent_details 4. REVOKE CONSENT Action: Graph API - DELETE OAuth2PermissionGrant URL: /oauth2PermissionGrants/{consent_id} 5. REMOVE SERVICE PRINCIPAL (Optional) Action: Graph API - DELETE ServicePrincipal URL: /servicePrincipals/{sp_id} Note: Only if app is clearly malicious 6. NOTIFY USER Action: Send email To: user_principal_name Subject: "Security Action: Application Removed" Body: "We removed {app_name} from your account..." 7. ENRICH INVESTIGATION Action: Check if other users consented Query: All consents to same app_id 8. UPDATE ALERT Action: Close alert with remediation notes

Navigate to: GreyMatter Dashboards Create EXECUTIVE IDENTITY DASHBOARD TILE 1: Identity Risk Overview (Pie Chart) source:entra_risky_users | stats count by riskLevel | render piechart TILE 2: Sign-in Success Rate (KPI) source:entra_signin_logs | where timestamp > now() - 24h | stats success = countif(resultType == "0"), total = count() | eval success_rate = round(success/total * 100, 1) TILE 3: Identity Alerts by Severity (Bar) source:greymatter_alerts | where category == "Identity" | where timestamp > now() - 7d | stats count by severity | render barchart TILE 4: MFA Adoption Rate (Gauge) source:entra_user_registration | stats mfa_enabled = countif(mfaRegistered == true), total = count() | eval mfa_rate = mfa_enabled/total * 100 TILE 5: Top Risky Users (Table) source:entra_risky_users | where riskLevel IN ("high", "medium") | table userPrincipalName, riskLevel, riskState, riskLastUpdatedDateTime | limit 10 TILE 6: Identity Incidents Trend (Line) source:greymatter_incidents | where category == "Identity" | stats count by bin(timestamp, 1d) | render timechart

# SOC Identity Operations Dashboard # TILE: Real-time Sign-in Failures source:entra_signin_logs | where timestamp > now() - 1h | where resultType != "0" | stats count by bin(timestamp, 5m) | render timechart # TILE: Active Brute Force Attacks source:entra_signin_logs | where timestamp > now() - 15m | where resultType IN ("50126", "50053") // Bad password, locked | stats target_count = dc(userPrincipalName), attempt_count = count() by ipAddress | where target_count > 5 | sort target_count desc # TILE: Privileged Activity Monitor source:entra_audit_logs | where timestamp > now() - 4h | where activityDisplayName IN ( "Add member to role", "Add member to role in PIM completed", "Add service principal credentials", "Consent to application" ) | table timestamp, activityDisplayName, initiatedBy.user.userPrincipalName # TILE: Open Identity Alerts source:greymatter_alerts | where status == "open" | where category == "Identity" | stats count by severity, ruleName | sort severity desc # TILE: Response Actions Executed source:greymatter_response_log | where timestamp > now() - 24h | where action_type IN ("disable_user", "revoke_sessions") | table timestamp, action_type, target, executed_by

SCHEDULED REPORTS: Navigate to: GreyMatter Reports Scheduled REPORT 1: Weekly Identity Security Summary Schedule: Every Monday 8 AM Recipients: CISO, Security Leadership Contents: - Total sign-in attempts (success/failure) - Risky users count by level - Identity alerts by severity - MFA enforcement status - Privileged role changes - Automated response actions --- REPORT 2: Monthly Privileged Access Audit Schedule: 1st of month Recipients: IT Audit, Compliance Contents: - All privileged role assignments - PIM activations with justifications - Direct assignments (bypassing PIM) - Privileged users by role - Access review completion status --- REPORT 3: Daily High-Risk Alert Digest Schedule: Daily 6 AM Recipients: SOC Team Lead Contents: - Critical/High identity alerts (last 24h) - Unresolved alerts >24h old - Response actions taken - Users currently disabled

Identity Security KPIs: DETECTION METRICS: Mean Time to Detect (MTTD) - Target: < 15 minutes for critical │ - Measure: Alert timestamp - event timestamp │ ├── Detection Coverage │ - % of MITRE techniques with rules │ - Target: >80% for identity tactics True Positive Rate - Target: > 80% - Track: TP / (TP + FP) RESPONSE METRICS: Mean Time to Respond (MTTR) - Target: < 30 minutes for critical │ - Measure: Response action - alert time │ ├── Automated Response Rate │ - % alerts with auto-response │ - Target: >50% for known threats Containment Effectiveness - % compromised accounts contained - Before data exfiltration COMPLIANCE METRICS: MFA Adoption Rate - Target: 100% for privileged, 95% all users Privileged Account Ratio - Privileged users / total users - Target: < 1% │ └── Access Review Completion - Target: 100% on schedule

Relevant Threat Intelligence for Identity: IP REPUTATION: Known malicious IPs Tor exit nodes VPN/Proxy services Botnet C2 infrastructure Credential stuffing sources CREDENTIAL INTELLIGENCE: Leaked credential databases Dark web monitoring Paste site monitoring Breach notification feeds THREAT ACTOR INTELLIGENCE: APT group TTPs Campaign indicators Targeted industries Common attack patterns INTEGRATION POINTS: 1. Enrich sign-in events with IP reputation 2. Alert on leaked credentials (HaveIBeenPwned style) 3. Correlate with known attack campaigns 4. Prioritize alerts based on threat actor FEEDS TO INTEGRATE: - ReliaQuest Threat Intelligence - Microsoft Defender TI - AlienVault OTX - Recorded Future - GreyNoise (benign scanner identification) - SpamHaus (known bad IPs)

# Detection with Threat Intel Enrichment # Rule: Sign-in from Known Malicious IP source:entra_signin_logs | where resultType == "0" // Successful | lookup threat_intel_ips ON ipAddress | where threat_category IS NOT NULL | where threat_category IN ( "malware", "botnet", "phishing", "credential_stuffing" ) | project timestamp, userPrincipalName, ipAddress, threat_category, threat_confidence, threat_source # Severity mapping: # threat_confidence > 90 = Critical # threat_confidence > 70 = High # threat_confidence > 50 = Medium --- # Rule: Sign-in from Tor Exit Node source:entra_signin_logs | where resultType == "0" | lookup tor_exit_nodes ON ipAddress | where is_tor_exit == true | project timestamp, userPrincipalName, ipAddress, location # Note: Some legitimate users use Tor # Consider user role and historical behavior

Leaked Credential Detection: OPTION 1: Microsoft Identity Protection - Built-in leaked credential detection - Ingested via Risk Detections API - Automatic user risk elevation Detection Rule: source:entra_risk_detections | where riskEventType == "leakedCredentials" | project timestamp, userPrincipalName, riskLevel, additionalInfo --- OPTION 2: External Dark Web Monitoring Integration with ReliaQuest Digital Shadows: - Monitor dark web for company credentials - Alert when employee emails found in breaches - Proactive password reset recommendations Workflow: 1. Dark web monitor finds credential 2. Alert created in GreyMatter 3. Correlate with Entra ID user 4. Check if password was changed since breach 5. If not: Force password reset 6. Notify user of exposure Detection: source:dark_web_intel | where exposed_domain == "contoso.com" | lookup entra_users ON email | where user_exists == true | where last_password_change < breach_date | project email, breach_source, breach_date

# Business Email Compromise (BEC) Detection # Multi-stage detection combining identity + email signals # Stage 1: Suspicious sign-in source:entra_signin_logs | where riskLevelDuringSignIn IN ("high", "medium") | where resultType == "0" // Successful despite risk | eval stage1_indicator = true # Stage 2: Inbox rule creation (persistence) source:office365_audit | where operation == "New-InboxRule" | where parameters CONTAINS "ForwardTo" OR parameters CONTAINS "RedirectTo" | eval stage2_indicator = true # Stage 3: Email to finance/HR (execution) source:email_logs | where sender_risk_score > 50 | where recipient_department IN ("Finance", "HR", "Executive") | where subject CONTAINS_ANY ("invoice", "wire", "urgent", "payment") | eval stage3_indicator = true # Correlation rule | join stage1, stage2, stage3 on userPrincipalName | where stage1_time < stage2_time < stage3_time | where (stage3_time - stage1_time) < 24h # Alert: BEC Attack Chain Detected Severity: Critical Response: Disable user, revoke sessions, quarantine emails

# Insider Threat / Departing Employee Detection # Combine HR data with identity activity # Watchlist: Employees on notice period source:hr_system | where employment_status == "notice_period" | where termination_date > now() | project userPrincipalName, termination_date, department # Monitor: Unusual data access source:entra_signin_logs | join watchlist ON userPrincipalName | where appDisplayName IN ("SharePoint", "OneDrive", "Teams") | stats login_count = count(), apps = dc(appDisplayName), data_accessed = sum(bytes_downloaded) by userPrincipalName, bin(timestamp, 1d) # Alert: Access volume significantly higher than baseline | join user_baseline ON userPrincipalName | where data_accessed > baseline_avg * 3 | where login_count > baseline_logins * 2 # Additional signals: # - After-hours access # - Access to new/unusual sites # - Large downloads # - External sharing increases # Response: # - Alert manager # - Increase monitoring # - Consider access reduction

# Third-Party/Guest User Compromise Detection # Monitor B2B guest user activity # Baseline: Normal guest behavior source:entra_signin_logs | where userType == "Guest" | where timestamp < now() - 7d | stats normal_apps = values(appDisplayName), normal_hours = values(hourofday(timestamp)), normal_locations = values(location) by userPrincipalName # Detection: Anomalous guest activity source:entra_signin_logs | where userType == "Guest" | where timestamp > now() - 24h | join guest_baseline ON userPrincipalName | where appDisplayName NOT IN (normal_apps) OR location NOT IN (normal_locations) OR hourofday(timestamp) NOT IN (normal_hours) # High-risk guest behaviors: # - Accessing admin portals # - Accessing internal SharePoint (not their project) # - Sign-in from new country # - Elevated permissions # Additional rule: Guest elevation source:entra_audit_logs | where targetResources[0].userPrincipalName CONTAINS "#EXT#" | where activityDisplayName IN ( "Add member to role", "Add member to group" ) | where targetGroup.displayName CONTAINS "admin" OR targetRole.displayName CONTAINS "Administrator" # Response: # - Verify with sponsoring employee # - Temporary access suspension # - Partner security notification

MASTER PLAYBOOK: Identity Incident Response TRIGGER: Critical identity alert confirmed PHASE 1: IMMEDIATE CONTAINMENT (0-5 min) 1.1 Disable user account 1.2 Revoke all sessions 1.3 Block source IP (if identified) 1.4 Confirm user compromised (risk API) 1.5 Notify SOC on-call PHASE 2: INITIAL INVESTIGATION (5-30 min) 2.1 Enrich user context (role, dept, VIP) 2.2 Pull sign-in history (7 days) 2.3 Pull audit history (7 days) 2.4 Check for persistence mechanisms 2.5 Identify all accessed applications 2.6 Determine compromise timeline PHASE 3: SCOPE ASSESSMENT (30-60 min) 3.1 Check lateral movement (other users from same IP) 3.2 Identify data accessed/exfiltrated 3.3 Check email forwarding rules 3.4 Verify OAuth applications 3.5 Assess business impact 3.6 Escalate if needed (legal, exec) PHASE 4: ERADICATION (1-4 hours) 4.1 Remove malicious OAuth apps 4.2 Remove persistence (rules, creds) 4.3 Reset password 4.4 Clear MFA, require re-registration 4.5 Verify all artifacts removed 4.6 Document all changes PHASE 5: RECOVERY (4-24 hours) 5.1 Re-enable account 5.2 User re-enrolls MFA 5.3 Verify access restored 5.4 Monitor closely for 7 days 5.5 User awareness training PHASE 6: POST-INCIDENT 6.1 Full incident documentation 6.2 IOC extraction and sharing 6.3 Detection rule improvements 6.4 Lessons learned meeting 6.5 Report to stakeholders