Even MOAR Powershell, looking at Entra logins - the good, the bad and the password sprays, (Fri, Aug 21st)

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

One thing that folks never seem to do after "going to the CLOOOOUUUUD" is to look at their logs, logs that they would have checked daily when things were on premise. One log that really bears looking at is the log of successful and failed logins.  the call for that is:

# import needed, if they're not already in place Import-Module Microsoft.Graph.Reports

# connect with the correct scope Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"

$f = Get-MgAuditLogSignIn

Let's look at one object in the log:

This is an interactive login to OWA, which failed on a conditional access check What is that under location though - that's likely why this failed.  How do we get the "where" from that?  And why does the status got a similar string in it instead of an actual status? The command below shows us pulling only failed logins ("status/errorCode ne 0"), extracting the geo location info, and also the failure reason

Get-MgAuditLogSignIn -Filter "status/errorCode ne 0" -All | Select-Object `     CreatedDateTime,      UserPrincipalName,      IPAddress,      @{Name="City"; Expression={$_.Location.City}},      @{Name="State"; Expression={$_.Location.State}},      @{Name="Country"; Expression={$_.Location.CountryOrRegion}},     @{Name="FailureReason"; Expression={$_.Status.FailureReason}}

Aha!  Now we have that otherwise hidden information!  It's this sort of list where you'll see password sprays show up.  The list below shows part of such an attack, note that the last two lines show the account is locked.  The "IP address with malicious activity" alert generally means …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://isc.sans.edu/diary/rss/33268
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.