CredentialsAddAfterAdminConsentedToApp[Nobelium]

Description

Credentials were added to an application by UserA, after the application was granted admin consent rights by UserB The Nobelium activity group has been observed adding credentials (x509 keys or password credentials) for one or more legitimate OAuth Applications or Service Principals, usually with existing Mail.Read or Mail.ReadWrite permissions, which grants the ability to read mail content from Exchange Online via Microsoft Graph or Outlook REST. Examples include mail archiving applications. See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate). See Grant tenant-wide admin consent to an application for how to add admin consent to an application. More Nobelium-related queries can be found listed under the See also section of this document. References: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ https://docs.microsoft.com/azure/active-directory/manage-apps/grant-admin-consent

Query · kql

CloudAppEvents
| where Application == "Office 365"
| where ActionType == "Consent to application."
| where RawEventData.ModifiedProperties[0].Name == "ConsentContext.IsAdminConsent" and RawEventData.ModifiedProperties[0].NewValue == "True"
| extend spnID = tostring(RawEventData.Target[3].ID)
| parse RawEventData.ModifiedProperties[4].NewValue with * "=> [[" dummpy "Scope: " After "]]" *
| extend PermissionsGranted = split(After, "]",0)
| project ConsentTime = Timestamp , AccountDisplayName , spnID , PermissionsGranted
| join (
 CloudAppEvents
 | where Application == "Office 365"
 | where ActionType == "Add service principal credentials." or ActionType == "Update application - Certificates and secrets management "
 | extend spnID = tostring(RawEventData.Target[3].ID) 
 | project AddSecretTime = Timestamp, AccountDisplayName , spnID 
 ) on spnID 
| where ConsentTime < AddSecretTime and AccountDisplayName <> AccountDisplayName1
Raw source CredentialsAddAfterAdminConsentedToApp[Nobelium] · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 0d49b34e-ac5a-441f-a79f-672ad045870e
name: CredentialsAddAfterAdminConsentedToApp[Nobelium]
description: |
  Credentials were added to an application by UserA, after the application was granted admin consent rights by UserB
  The Nobelium activity group has been observed adding credentials (x509 keys or password credentials) for one or more legitimate OAuth Applications or Service Principals, usually with existing Mail.Read or Mail.ReadWrite permissions, which grants the ability to read mail content from Exchange Online via Microsoft Graph or Outlook REST. Examples include mail archiving applications.
  See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate).
  See Grant tenant-wide admin consent to an application for how to add admin consent to an application.
  More Nobelium-related queries can be found listed under the See also section of this document.
  References:
  https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
  https://docs.microsoft.com/azure/active-directory/manage-apps/grant-admin-consent
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Persistence
tags:
- Nobelium
query: |
  CloudAppEvents
  | where Application == "Office 365"
  | where ActionType == "Consent to application."
  | where RawEventData.ModifiedProperties[0].Name == "ConsentContext.IsAdminConsent" and RawEventData.ModifiedProperties[0].NewValue == "True"
  | extend spnID = tostring(RawEventData.Target[3].ID)
  | parse RawEventData.ModifiedProperties[4].NewValue with * "=> [[" dummpy "Scope: " After "]]" *
  | extend PermissionsGranted = split(After, "]",0)
  | project ConsentTime = Timestamp , AccountDisplayName , spnID , PermissionsGranted
  | join (
   CloudAppEvents
   | where Application == "Office 365"
   | where ActionType == "Add service principal credentials." or ActionType == "Update application - Certificates and secrets management "
   | extend spnID = tostring(RawEventData.Target[3].ID) 
   | project AddSecretTime = Timestamp, AccountDisplayName , spnID 
   ) on spnID 
  | where ConsentTime < AddSecretTime and AccountDisplayName <> AccountDisplayName1

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.