Correlate Azure AD, Activity, and Blob Storage logs in Elastic Stack to reconstruct an attack timeline, identifying initial access, lateral movement, persistence, and data exfiltration.
A finance company's Azure environment has flagged multiple failed login attempts from an unfamiliar geographic location, followed by a successful authentication. Shortly after, logs indicate access to sensitive Blob Storage files and a virtual machine start action. Investigate authentication logs, storage access patterns, and VM activity to determine the scope of the compromise.
Easy - Cloud Forensics | Completion Achievement
- As a US-based company, the security team has observed significant suspicious activity from an unusual country. What is the name of the country from which the attack originated?
Looking at the available fields in the ELK instance, we can see a few fields related to the country of origin of the logs:
Once we click in the source.geo.country_name field, we will be able to see the countries that generated Azure activity:
Since this is a US-based company, it is expected that most activity would come from the US. The country with the least activity is unlikely to be our suspect. Let's look deeper into the second country in our investigation.
- To establish an accurate incident timeline, what is the timestamp of the initial activity originating from the country?
We can click on the + sign after Germany to filter all the logs that came from Germany. Once we do that, we must sort the logs based on their timestamp (Sort Old-New) to retrieve the logs in chronological order. The first log will contain the timestamp for the initial activity coming from Germany.
- To assess the scope of compromise, we must determine the attacker's entry point. What is the display name of the compromised user account?
We need to find the display name of the user account belonging to the initial activity from Germany. We can expand the first logs and filter for any fields containing the display string. Many of the first logs are related to a single user account:
- To gain insights into the attacker's tactics and enumeration strategy, what is the name of the script file the attacker accessed within blob storage?
Let's use the ELK search bar to filter events displaying blob storage. The azure.eventhub.category:StorageRead and azure.eventhub.operationName:GetBlob query will returns events displayed files being read from blob storage. Looking at the events after the first activity timestamp, we can find our answer inside the objectKey field :
- For a detailed analysis of the attacker's actions, what is the name of the storage account housing the script file?
Filtering for the accountName filter on the previous event log will display the storage account that houses this script file:
- Tracing the attacker's movements across our infrastructure, what is the User Principal Name (UPN) of the second user account the attacker compromised?
Going back to the log-in events coming from Germany, we can find a source IP address to look for further log-in attempts:
Let's filter all logs based on this query: source.ip:85.203.15.37. Then, let's look for fields that could reveal the UPN of the user. The email field worked in my case to find the UPN:
- Analyzing the attacker's impact on our environment, what is the name of the Virtual Machine (VM) the attacker started?
Let's use the event.action.keyword field to find anything related to VM startup. The MICROSOFT.COMPUTE/VIRTUALMACHINES/START/ACTION value looks good, let's look at some logs related to this action:
- To assess the potential data exposure, what is the name of the database exported?
Let's look at the event.action.keyword field again to find anything interesting related to databases. The MICROSOFT.SQL/SERVERS/DATABASES/EXPORT/ACTION value stands out, let's filter the logs to display events related to the export of databases:
- In your pursuit of uncovering persistence techniques, what is the display name associated with the user account you have discovered?
Looking at the event.acion field action, we can find the Add user value, which corresponds to a new user being added to the system for persistence. Using the event.action.keyword:"Add user" filter will display an event log showcasing the name of the account created by the attacker:
- The attacker utilized a compromised account to assign a new role. What role was granted?
By using the MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE field from event.action, we can see logs detailing how roles were changed. We can filter the fields inside the returned logs with the role keyword to find which role was granted:
- For a comprehensive timeline and understanding of the breach progression, What is the timestamp of the first successful login recorded for this user account?
The new user account created by the attacker (IT Support) must have logged in at some point. Using the user.full_name.keyword filter, we can find the first signs of activity coming from the newly created account:
