Wednesday, May 31, 2023

AzureHunter - A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365


A Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.


Getting Started

1. Check that you have the right O365 Permissions

The following roles are required in Exchange Online, in order to be able to have read only access to the UnifiedAuditLog: View-Only Audit Logs or Audit Logs.

These roles are assigned by default to the Compliance Management role group in Exchange Admin Center.

NOTE: if you are a security analyst, incident responder or threat hunter and your organization is NOT giving you read-only access to these audit logs, you need to seriously question what their detection and response strategy is!

More information:

NOTE: your admin can verify these requirements by running Get-ManagementRoleEntry "*\Search-UnifiedAuditLog" in your Azure tenancy cloud shell or local powershell instance connected to Azure.


2. Ensure ExchangeOnlineManagement v2 PowerShell Module is installed

Please make sure you have ExchangeOnlineManagement (EXOv2) installed. You can find instructions on the web or go directly to my little KB on how to do it at the soc analyst scrolls


3. Either Clone the Repo or Install AzureHunter from the PSGallery

3.1 Cloning the Repo
  1. Clone this repository
  2. Import the module Import-Module .\source\AzureHunter.psd1

3.2 Install AzureHunter from the PSGallery

All you need to do is:

Install-Module AzureHunter -Scope CurrentUser
Import-Module AzureHunter

What is the UnifiedAuditLog?

The unified audit log contains user, group, application, domain, and directory activities performed in the Microsoft 365 admin center or in the Azure management portal. For a complete list of Azure AD events, see the list of RecordTypes.

The UnifiedAuditLog is a great source of cloud forensic information since it contains a wealth of data on multiple types of cloud operations like ExchangeItems, SharePoint, Azure AD, OneDrive, Data Governance, Data Loss Prevention, Windows Defender Alerts and Quarantine events, Threat intelligence events in Microsoft Defender for Office 365 and the list goes on and on!


AzureHunter Data Consistency Checks

AzureHunter implements some useful logic to ensure that the highest log density is mined and exported from Azure & O365 Audit Logs. In order to do this, we run two different operations for each cycle (batch):

  1. Automatic Window Time Reduction: this check ensures that the time interval is reduced to the optimal interval based on the ResultSizeUpperThreshold parameter which by default is 20k. This means, if the amounts of logs returned within your designated TimeInterval is higher than ResultSizeUpperThreshold, then an automatic adjustment will take place.
  2. Sequential Data Check: are returned Record Indexes sequentially valid?



Usage

Ensure you connect to ExchangeOnline

It's recommended that you run Connect-ExchangeOnline before running any AzureHunter commands. The program checks for an active remote session and attempts to connect but some versions of Powershell don't allow this and you need to do it yourself regardless.


Run AzureHunter

AzureHunter has two main commands: Search-AzureCloudUnifiedLog and Invoke-HuntAzureAuditLogs.

The purpose of Search-AzureCloudUnifiedLog is to implement a complex logic to ensure that the highest percentage of UnifiedAuditLog records are mined from Azure. By default, it will export extracted and deduplicated records to a CSV file.

The purpose of Invoke-HuntAzureAuditLogs is to provide a flexible interface into hunting playbooks stored in the playbooks folder. These playbooks are designed so that anyone can contribute with their own analytics and ideas. So far, only two very simple playbooks have been developed: AzHunter.Playbook.Exporter and AzHunter.Playbook.LogonAnalyser. The Exporter takes care of exporting records after applying de-duplication and sorting operations to the data. The LogonAnalyser is in beta mode and extracts events where the Operations property is UserLoggedIn. It is an example of what can be done with the playbooks and how easy it is to construct one.

When running Search-AzureCloudUnifiedLog, you can pass in a list of playbooks to run per log batch. Search-AzureCloudUnifiedLog will pass on the batch to the playbooks via Invoke-HuntAzureAuditLogs.

Finally Invoke-HuntAzureAuditLogs can, be used standalone. If you have an export of UnifiedAuditLog records, you can load them into a Powershell Array and pass them on to this command and specify the relevant playbooks.


Example 1 | Run search on Azure UnifiedAuditLog and extract records to CSV file (default behaviour)
Search-AzureCloudUnifiedLog -StartDate "2020-03-06T10:00:00" -EndDate "2020-06-09T12:40:00" -TimeInterval 12 -AggregatedResultsFlushSize 5000 -Verbose

This command will:

  • Search data between the dates in StartDate and EndDate
  • Implement a window of 12 hours between these dates, which will be used to sweep the entire length of the time interval (StartDate --> EndDate). This window will be automatically reduced and adjusted to provide the maximum amount of records within the window, thus ensuring higher quality of output. The time window slides sequentially until reaching the EndDate.
  • The AggregatedResultsFlushSize parameter speficies the batches of records that will be processed by downstream playbooks. We are telling AzureHunter here to process the batch of records once the total amount reaches 5000. This way, you can get results on the fly, without having to wait for hours until a huge span of records is exported to CSV files.

Example 2 | Run Hunting Playbooks on CSV File

We assume that you have exported UnifiedAuditLog records to a CSV file, if so you can then do:

$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-HuntAzureAuditLogs -Records $RecordArray -Playbooks 'AzHunter.Playbook.LogonAnalyser'

You can run more than one playbook by separating them via commas, they will run sequentially:

$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-HuntAzureAuditLogs -Records $RecordArray -Playbooks 'AzHunter.Playbook.Exporter', 'AzHunter.Playbook.LogonAnalyser'

Why?

Since the aftermath of the SolarWinds Supply Chain Compromise many tools have emerged out of deep forges of cyberforensicators, carefully developed by cyber blacksmith ninjas. These tools usually help you perform cloud forensics in Azure. My intention with AzureHunter is not to bring more noise to this crowded space, however, I found myself in the need to address some gaps that I have observed in some of the tools in the space (I might be wrong though, since there is a proliferation of tools out there and I don't know them all...):

  1. Azure cloud forensic tools don't usually address the complications of the Powershell API for the UnifiedAuditLog. This API is very unstable and inconsistent when exporting large quantities of data. I wanted to develop an interface that is fault tolerant (enough) to address some of these issues focusing solely on the UnifiedAuditLog since this is the Azure artefact that contains the most relevant and detailed activity logs for users, applications and services.
  2. Azure cloud forensic tools don't usually put focus on developing extensible Playbooks. I wanted to come up with a simple framework that would help the community create and share new playbooks to extract different types of meaning off the same data.

If, however, you are looking for a more feature rich and mature application for Azure Cloud Forensics I would suggest you check out the excellent work performed by the cyber security experts that created the following applications:

I'm sure there is a more extensive list of tools, but these are the ones I could come up with. Feel free to suggest some more.


Why Powershell?
  1. I didn't want to re-invent the wheel
  2. Yes the Powershell interface to Azure's UnifiedAuditLog is unstable, but in terms of time-to-production it would have taken me an insane amount of hours to achieve the same thing writing a whole new interface in languages such as .NET, Golang or Python to achieve the same objectives. In the meanwhile, the world of Cyber Defense and Response does not wait!

TODO
  • Specify standard playbook metadata attributes that need to be present so that AzureHunter can leverage them.
  • Allow for playbooks to specify dependencies on other playbooks so that one needs to be run before the other. Playbook chaining could produce interesting results and avoid code duplication.
  • Develop Pester tests and Coveralls results.
  • Develop documentation in ReadTheDocs.
  • Allow for the specification of playbooks in SIGMA rule standard (this might require some PR to the SIGMA repo)

More Information

For more information


Credits


Read more
  1. Hack Apps
  2. Hacking Tools For Windows 7
  3. Blackhat Hacker Tools
  4. Hacker Security Tools
  5. Hack Tools Github
  6. Hack Website Online Tool
  7. Hack Tools Github
  8. Tools For Hacker
  9. Pentest Tools For Android
  10. Black Hat Hacker Tools
  11. Pentest Tools Windows
  12. Hacking Tools For Windows
  13. Underground Hacker Sites
  14. Best Pentesting Tools 2018
  15. Hack Tool Apk
  16. Pentest Box Tools Download
  17. Hak5 Tools
  18. Hack Tools For Pc
  19. Pentest Tools Free
  20. Pentest Tools For Ubuntu
  21. Pentest Tools Free
  22. Pentest Tools Kali Linux
  23. Hacking Tools Software
  24. Hacking Tools Github
  25. Best Hacking Tools 2019
  26. Hacking Tools For Windows
  27. Free Pentest Tools For Windows
  28. Hack Tools Online
  29. Hack Tools
  30. Pentest Tools Url Fuzzer
  31. Hacker Tools Apk
  32. Hacking Tools 2019
  33. Hacker Tools Windows
  34. Best Hacking Tools 2020
  35. Hacking Tools Github
  36. Hacker Tools 2020
  37. Pentest Tools For Mac
  38. Pentest Tools Nmap
  39. Hack Tools For Pc
  40. Hacker Tools Hardware
  41. Hacking App
  42. Bluetooth Hacking Tools Kali
  43. Beginner Hacker Tools
  44. Hacking Tools For Beginners
  45. Pentest Tools Website
  46. Hacker Tools List
  47. Hacking Tools Software
  48. Physical Pentest Tools
  49. Pentest Automation Tools
  50. Pentest Tools Review
  51. Hacker Tools Apk
  52. Hack Tools For Games
  53. Hacking Tools Kit
  54. Hacker Tools Linux
  55. Hacker Tools Online
  56. Usb Pentest Tools
  57. Growth Hacker Tools
  58. Install Pentest Tools Ubuntu
  59. Hack App
  60. Top Pentest Tools
  61. Usb Pentest Tools
  62. Hacker Tools For Mac
  63. Hack Tools Download
  64. Hak5 Tools
  65. Hacking Tools Mac
  66. Pentest Tools Port Scanner
  67. Hacker Tools Free
  68. Top Pentest Tools
  69. Hack Website Online Tool
  70. Hacking Tools Pc
  71. Pentest Tools Alternative
  72. Usb Pentest Tools
  73. How To Install Pentest Tools In Ubuntu
  74. Beginner Hacker Tools
  75. Hacking Tools Github
  76. Best Hacking Tools 2019
  77. Hacker Tools Software
  78. Hacker Tools 2019
  79. New Hacker Tools
  80. Hack Tools For Windows
  81. Hacking Tools For Beginners
  82. Pentest Tools Framework
  83. Hacker Tools 2019
  84. Hacker Tools For Pc
  85. Pentest Tools Free
  86. Hacking Tools For Pc
  87. Hack Tools For Games
  88. Hack Tools Download
  89. Pentest Reporting Tools
  90. Hack Tools For Pc
  91. Pentest Tools Bluekeep
  92. Github Hacking Tools
  93. Hacking Tools 2019
  94. Android Hack Tools Github
  95. Pentest Tools Framework
  96. Hacking Tools For Pc
  97. Hacker Tools Apk Download
  98. Physical Pentest Tools
  99. Blackhat Hacker Tools
  100. Hacking Apps
  101. Game Hacking
  102. Underground Hacker Sites
  103. Hacking Tools
  104. Hacking Tools Mac
  105. Hack Tools Online
  106. Hacker Search Tools
  107. Hack Rom Tools
  108. Android Hack Tools Github
  109. Hack Tools
  110. Hacking Tools 2019
  111. Pentest Tools Subdomain
  112. Pentest Tools Github
  113. Hacking Apps
  114. Hacker Tools 2020
  115. Pentest Tools Android
  116. Game Hacking
  117. Hacking Tools Download
  118. Hacking Tools For Pc
  119. Hacking Tools Pc
  120. Hack Tools
  121. Pentest Tools Website Vulnerability
  122. Pentest Tools Kali Linux
  123. Hack Tools
  124. Hack Tools For Mac
  125. Hacking Tools For Windows Free Download
  126. Tools 4 Hack
  127. Hacker Tools Apk
  128. Nsa Hack Tools Download
  129. Pentest Tools For Windows
  130. How To Install Pentest Tools In Ubuntu
  131. Hacking Tools For Windows Free Download
  132. Hacker Tools Software
  133. Pentest Tools Download
  134. Hacking Tools Windows 10
  135. Hacker Tools 2020
  136. Tools For Hacker
  137. Hacking Tools Free Download
  138. Wifi Hacker Tools For Windows
  139. Hacking Tools Hardware
  140. Pentest Tools Find Subdomains
  141. Easy Hack Tools
  142. Android Hack Tools Github
  143. Underground Hacker Sites
  144. Best Hacking Tools 2019
  145. Hacking Tools For Games
  146. What Are Hacking Tools
  147. Hacker Tools Linux
  148. Pentest Recon Tools
  149. Pentest Box Tools Download
  150. Easy Hack Tools
  151. Hacker Tools Free
  152. Hacking Tools Software
  153. Hack Tools For Windows
  154. Nsa Hack Tools
  155. Hack Tools Github
  156. Hacking Tools Mac

No comments: