[Meta] Explore Microsoft Graph Activity Logs for Detections

[terrancedejesus]

Parent Epic (If Applicable)

• https://github.com/elastic/ia-trade-team/issues/272

Meta Summary

Adversaries continue to leverage Microsoft Graph for command and control operations for malicious binaries. However, it is also a target for adversaries as it serves a RESTful API for access to Azure resources such as Entra ID. For this meta, we will setup the integration, ingest activity logs, emulate adversary TTPs and determine plausible detections.

• Note: We may also want to think about Entity Analytics and CSPM and how these may help with asset visibility.

Microsoft Graph Activity Logs provide an audit trail of all HTTP requests that the Microsoft Graph service has received and processed for a tenant. Microsoft Graph Activity Logs gives full visibility into all transactions made by applications and other API clients that you have consented to in the tenant. Refer to Microsoft Graph Activity Common Usecases for more use cases.

Tenant administrators can configure the collection and storage destinations of Microsoft Graph Activity Logs through Diagnostic Setting in the Entra Portal. This integration uses Azure Event Hubs destination to stream Microsoft Graph Activity Logs to Elastic.

Estimated Time to Complete

4 weeks (2 weeks for lab setup and exploration, 2 weeks for detections)

Tasklist

This tasklist will grow as we explore, emulate and test.

Meta Tasks

Beta Give feedback

1. Provide Week 1 Update Comment
2. Provide Week 2 Update or Closeout Comment
3. Setup lab environment and infrastructure
4. Review existing TTPs reported and historical abuse
5. Provide 10 new detection rules
6. Write a blog

Resources / References

• https://kqlquery.com/posts/graphactivitylogs/
• https://twitter.com/NathanMcNulty/status/1785051227568632263?s=19
• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/graph-api-threats
• https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/graphql
• https://cloud.hacktricks.xyz/pentesting-cloud/azure-security

We should also sync with https://github.com/elastic/infosec/issues/15196 on findings.