Skip to content

Commit 4728c33

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #309861 from guywi-ms/new-ueba-anomalies
Update anomalies-reference.md
2 parents 847ca34 + 0598d6e commit 4728c33

1 file changed

Lines changed: 77 additions & 2 deletions

File tree

‎articles/sentinel/anomalies-reference.md‎

Lines changed: 77 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,18 @@ UEBA detects anomalies based on these anomaly rules:
5151
- [UEBA Anomalous Authentication (Preview)](#ueba-anomalous-authentication-preview)
5252
- [UEBA Anomalous Code Execution](#ueba-anomalous-code-execution)
5353
- [UEBA Anomalous Data Destruction](#ueba-anomalous-data-destruction)
54+
- [UEBA Anomalous Data Transfer from Amazon S3 (Preview)](#ueba-anomalous-data-transfer-from-amazon-s3-preview)
5455
- [UEBA Anomalous Defensive Mechanism Modification](#ueba-anomalous-defensive-mechanism-modification)
5556
- [UEBA Anomalous Failed Sign-in](#ueba-anomalous-failed-sign-in)
57+
- [UEBA Anomalous Federated or SAML Identity Activity in AwsCloudTrail (Preview)](#ueba-anomalous-federated-or-saml-identity-activity-in-awscloudtrail-preview)
58+
- [UEBA Anomalous IAM Privilege Modification in AwsCloudTrail (Preview)](#ueba-anomalous-iam-privilege-modification-in-awscloudtrail-preview)
5659
- [UEBA Anomalous Logon in AwsCloudTrail (Preview)](#ueba-anomalous-logon-in-awscloudtrail-preview)
5760
- [UEBA Anomalous MFA Failures in Okta_CL (Preview)](#ueba-anomalous-mfa-failures-in-okta_cl-preview)
5861
- [UEBA Anomalous Password Reset](#ueba-anomalous-password-reset)
5962
- [UEBA Anomalous Privilege Granted](#ueba-anomalous-privilege-granted)
63+
- [UEBA Anomalous Secret or KMS Key Access in AwsCloudTrail (Preview)](#ueba-anomalous-secret-or-kms-key-access-in-awscloudtrail-preview)
6064
- [UEBA Anomalous Sign-in](#ueba-anomalous-sign-in)
65+
- [UEBA Anomalous STS AssumeRole Behavior in AwsCloudTrail (Preview)](#ueba-anomalous-sts-assumerole-behavior-in-awscloudtrail-preview)
6166

6267
Sentinel uses enriched data from the BehaviorAnalytics table to identify UEBA anomalies with a confidence score specific to your tenant and source.
6368

@@ -142,7 +147,7 @@ Sentinel uses enriched data from the BehaviorAnalytics table to identify UEBA an
142147
| **Data sources:** | Okta Cloud Logs |
143148
| **MITRE ATT&CK tactics:** | Persistence, Privilege Escalation |
144149
| **MITRE ATT&CK techniques:** | T1098 - Account Manipulation, T1556 - Modify Authentication Process |
145-
| **Activity:** | 'user.session.impersonation.grant'<br>'user.session.impersonation.initiate'<br>'user.session.start'<br>'app.oauth2.admin.consent.grant_success'<br>'app.oauth2.authorize.code_success'<br>'device.desktop_mfa.recovery_pin.generate'<br>'user.authentication.auth_via_mfa'<br>'user.mfa.attempt_bypass'<br>'user.mfa.factor.deactivate'<br>'user.mfa.factor.reset_all'<br>'user.mfa.factor.suspend'<br>'user.mfa.okta_verify' |
150+
| **Activity:** | user.session.impersonation.grant<br>user.session.impersonation.initiate<br>user.session.start<br>app.oauth2.admin.consent.grant_success<br>app.oauth2.authorize.code_success<br>device.desktop_mfa.recovery_pin.generate<br>user.authentication.auth_via_mfa<br>user.mfa.attempt_bypass<br>user.mfa.factor.deactivate<br>user.mfa.factor.reset_all<br>user.mfa.factor.suspend<br>user.mfa.okta_verify |
146151

147152
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
148153

@@ -190,6 +195,20 @@ Sentinel uses enriched data from the BehaviorAnalytics table to identify UEBA an
190195

191196
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
192197

198+
### UEBA Anomalous Data Transfer from Amazon S3 (Preview)
199+
200+
**Description:** Deviations in data access or download patterns from Amazon Simple Storage Service (S3). The anomaly is determined using behavioral baselines for each user, service, and resource, comparing data transfer volume, frequency, and accessed object count against historical norms. Significant deviations - such as first-time bulk access, unusually large data retrievals, or activity from new locations or applications - might indicate potential data exfiltration, policy violations, or misuse of compromised credentials.
201+
202+
| Attribute | Value |
203+
| -------------------------------- | ------------------------------------------------------------------ |
204+
| **Anomaly type:** | UEBA |
205+
| **Data sources:** | AWS CloudTrail logs |
206+
| **MITRE ATT&CK tactics:** | Exfiltration |
207+
| **MITRE ATT&CK techniques:** | T1567 - Exfiltration Over Web Service |
208+
| **Activity:** | PutObject, CopyObject, UploadPart, UploadPartCopy, CreateJob, CompleteMultipartUpload |
209+
210+
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
211+
193212
### UEBA Anomalous Defensive Mechanism Modification
194213

195214
**Description:** Adversaries may disable security tools to avoid possible detection of their tools and activities.
@@ -219,6 +238,34 @@ Sentinel uses enriched data from the BehaviorAnalytics table to identify UEBA an
219238

220239
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
221240

241+
### UEBA Anomalous Federated or SAML Identity Activity in AwsCloudTrail (Preview)
242+
243+
**Description:** Unusual activity by federated or Security Assertion Markup Language (SAML)-based identities involving first-time actions, unfamiliar geo-locations, or excessive API calls. Such anomalies can indicate session hijacking or misuse of federated credentials.
244+
245+
| Attribute | Value |
246+
| -------------------------------- | ------------------------------------------------------------------ |
247+
| **Anomaly type:** | UEBA |
248+
| **Data sources:** | AWS CloudTrail logs |
249+
| **MITRE ATT&CK tactics:** | Initial Access, Persistence |
250+
| **MITRE ATT&CK techniques:** | T1078 - Valid Accounts, T1550 - Use Alternate Authentication Material |
251+
| **Activity:** | UserAuthentication (EXTERNAL_IDP) |
252+
253+
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
254+
255+
### UEBA Anomalous IAM Privilege Modification in AwsCloudTrail (Preview)
256+
257+
**Description:** Deviations in Identity and Access Management (IAM) administrative behavior, such as first-time creation, modification, or deletion of roles, users, and groups, or attachment of new inline or managed policies. These might indicate privilege escalation or policy abuse.
258+
259+
| Attribute | Value |
260+
| -------------------------------- | ------------------------------------------------------------------ |
261+
| **Anomaly type:** | UEBA |
262+
| **Data sources:** | AWS CloudTrail logs |
263+
| **MITRE ATT&CK tactics:** | Privilege Escalation, Persistence |
264+
| **MITRE ATT&CK techniques:** | T1136 - Create Account, T1098 - Account Manipulation |
265+
| **Activity:** | Create, Add, Attach, Delete, Deactivate, Put, and Update operations on iam.amazonaws.com, sso-directory.amazonaws.com |
266+
267+
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
268+
222269
### UEBA Anomalous Logon in AwsCloudTrail (Preview)
223270

224271
**Description:** Unusual logon activity in Amazon Web Services (AWS) services based on CloudTrail events such as ConsoleLogin and other authentication-related attributes. Anomalies are determined by deviations in user behavior based on attributes like geolocation, device fingerprint, ISP, and access method, and may indicate unauthorized access attempts or potential policy violations.
@@ -229,7 +276,7 @@ Sentinel uses enriched data from the BehaviorAnalytics table to identify UEBA an
229276
| **Data sources:** | AWS CloudTrail logs |
230277
| **MITRE ATT&CK tactics:** | Initial Access |
231278
| **MITRE ATT&CK techniques:** | T1078 - Valid Accounts |
232-
| **Activity:** | signin.amazonaws.com |
279+
| **Activity:** | ConsoleLogin |
233280

234281
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
235282

@@ -277,6 +324,20 @@ Sentinel uses enriched data from the BehaviorAnalytics table to identify UEBA an
277324

278325
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
279326

327+
### UEBA Anomalous Secret or KMS Key Access in AwsCloudTrail (Preview)
328+
329+
**Description:** Suspicious access to AWS Secrets Manager, or Key Management Service (KMS) resources. First-time access or unusually high access frequency might indicate credential harvesting or data exfiltration attempts.
330+
331+
| Attribute | Value |
332+
| -------------------------------- | ------------------------------------------------------------------ |
333+
| **Anomaly type:** | UEBA |
334+
| **Data sources:** | AWS CloudTrail logs |
335+
| **MITRE ATT&CK tactics:** | Credential Access, Collection |
336+
| **MITRE ATT&CK techniques:** | T1555 - Credentials from Password Stores |
337+
| **Activity:** | GetSecretValue<br>BatchGetSecretValue <br>ListKeys<br>ListSecrets<br>PutSecretValue<br>CreateSecret<br>UpdateSecret<br>DeleteSecret<br>CreateKey<br>PutKeyPolicy |
338+
339+
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
340+
280341
### UEBA Anomalous Sign-in
281342

282343
**Description:** Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Persistence.
@@ -291,6 +352,20 @@ Sentinel uses enriched data from the BehaviorAnalytics table to identify UEBA an
291352

292353
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
293354

355+
### UEBA Anomalous STS AssumeRole Behavior in AwsCloudTrail (Preview)
356+
357+
**Description:** Anomalous usage of AWS Security Token Service (STS) AssumeRole actions, especially involving privileged roles or cross-account access. Deviations from typical usage might indicate privilege escalation or identity compromise.
358+
359+
| Attribute | Value |
360+
| -------------------------------- | ------------------------------------------------------------------ |
361+
| **Anomaly type:** | UEBA |
362+
| **Data sources:** | AWS CloudTrail logs |
363+
| **MITRE ATT&CK tactics:** | Privilege Escalation, Defense Evasion |
364+
| **MITRE ATT&CK techniques:** | T1548 - Abuse Elevation Control Mechanism, T1078 - Valid Accounts |
365+
| **Activity:** | AssumeRole<br>AssumeRoleWithSAML<br>AssumeRoleWithWebIdentity<br>AssumeRoot |
366+
367+
[Back to UEBA anomalies list](#ueba-anomalies) | [Back to top](#anomalies-detected-by-the-microsoft-sentinel-machine-learning-engine)
368+
294369
## Machine learning-based anomalies
295370

296371
Microsoft Sentinel's customizable, machine learning-based anomalies can identify anomalous behavior with analytics rule templates that can be put to work right out of the box. While anomalies don't necessarily indicate malicious or even suspicious behavior by themselves, they can be used to improve detections, investigations, and threat hunting.

0 commit comments

Comments
 (0)