Gather Victim Org Information

// T1591 — Gather Victim Org Information
// Detect bulk Azure AD / MS Graph enumeration of org structure (users, groups, roles, org details)
// This pattern indicates an authenticated attacker or compromised account mapping the org before deeper targeting
let LookbackWindow = 1h;
let EnumThreshold = 30;
let DistinctOpThreshold = 3;
AuditLogs
| where TimeGenerated >= ago(LookbackWindow)
| where OperationName in (
    "Get users",
    "List users",
    "Get groups",
    "List groups",
    "Get members",
    "Get organization",
    "Get directoryRoles",
    "List directoryRoleMembers",
    "Get contacts",
    "List contacts",
    "Get administrativeUnits",
    "List administrativeUnits"
  )
| where Result == "success"
| extend InitiatorUPN = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatorIP = tostring(InitiatedBy.user.ipAddress)
| extend AppDisplayName = tostring(InitiatedBy.app.displayName)
| where isnotempty(InitiatorUPN) or isnotempty(AppDisplayName)
| summarize
    OperationCount = count(),
    DistinctOperations = dcount(OperationName),
    Operations = make_set(OperationName),
    DistinctTargets = dcount(tostring(TargetResources)),
    EarliestEvent = min(TimeGenerated),
    LatestEvent = max(TimeGenerated)
    by InitiatorUPN, InitiatorIP, AppDisplayName, bin(TimeGenerated, LookbackWindow)
| where OperationCount >= EnumThreshold or DistinctOperations >= DistinctOpThreshold
| extend RiskScore = case(
    OperationCount >= 100 and DistinctOperations >= 5, "High",
    OperationCount >= 50 or DistinctOperations >= 4, "Medium",
    "Low"
  )
| project
    TimeGenerated,
    InitiatorUPN,
    InitiatorIP,
    AppDisplayName,
    OperationCount,
    DistinctOperations,
    DistinctTargets,
    Operations,
    RiskScore,
    EarliestEvent,
    LatestEvent
| order by OperationCount desc

index=* (sourcetype="ms:aad:audit" OR sourcetype="o365:management:activity" OR sourcetype="azure:aad:audit")
| search OperationName IN ("Get users", "List users", "Get groups", "List groups", "Get members", "Get organization", "Get directoryRoles", "List directoryRoleMembers", "Get contacts", "List contacts")
| eval InitiatorUPN=coalesce('InitiatedBy.user.userPrincipalName', 'UserId', "unknown")
| eval InitiatorIP=coalesce('InitiatedBy.user.ipAddress', 'ClientIP', "unknown")
| eval AppName=coalesce('InitiatedBy.app.displayName', 'ApplicationId', "unknown")
| where ResultStatus="Success" OR ResultStatus="succeeded"
| bin _time span=1h
| stats
    count AS OperationCount,
    dc(OperationName) AS DistinctOperations,
    values(OperationName) AS OperationList,
    dc(ObjectId) AS DistinctTargets
    by _time, InitiatorUPN, InitiatorIP, AppName
| where OperationCount >= 30 OR DistinctOperations >= 3
| eval RiskScore=case(
    OperationCount >= 100 AND DistinctOperations >= 5, "High",
    OperationCount >= 50 OR DistinctOperations >= 4, "Medium",
    1==1, "Low"
  )
| table _time, InitiatorUPN, InitiatorIP, AppName, OperationCount, DistinctOperations, DistinctTargets, OperationList, RiskScore
| sort - OperationCount

// T1591 — Gather Victim Org Information
any where event.dataset == "azure.auditlogs"
  and azure.auditlogs.operation_name in (
    "Get users", "List users", "Get groups", "List groups",
    "Get members", "Get organization", "Get directoryRoles",
    "List directoryRoleMembers", "Get contacts", "List contacts"
  )
  and azure.auditlogs.result == "success"

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "EventTime",
    LOGSOURCENAME(logsourceid) AS "LogSource",
    LOGSOURCETYPENAME(devicetype) AS "LogSourceType",
    "username", "sourceip", "destinationip",
    "eventid", "deviceaction", "message",
    CASE
        WHEN LOWER("operationname") ILIKE '%get users%' OR LOWER("operationname") ILIKE '%list groups%' OR LOWER("operationname") ILIKE '%get organization%' OR LOWER("operationname") ILIKE '%get directoryRoles%' THEN 8
        ELSE 4
      END AS "RiskScore"
  FROM events
  WHERE (LOWER("operationname") ILIKE '%get users%' OR LOWER("operationname") ILIKE '%list groups%' OR LOWER("operationname") ILIKE '%get organization%' OR LOWER("operationname") ILIKE '%get directoryRoles%')
    AND LOGSOURCETYPENAME(devicetype) NOT IN ('SIM Audit', 'Custom Rule Engine')
  ORDER BY "RiskScore" DESC, "EventTime" DESC
  LAST 24 HOURS

_sourceCategory=*azure*audit* OR _sourceCategory=*o365*
| json auto
| where OperationName in ("Get users","List users","Get groups","List groups","Get members","Get organization","Get directoryRoles")
| where ResultStatus = "Success"
| timeslice 1h
| stats count as OperationCount, dcount(OperationName) as DistinctOperations by _timeslice, InitiatorUPN, InitiatorIP
| where OperationCount >= 30 or DistinctOperations >= 3
| if(OperationCount >= 100 and DistinctOperations >= 5, "High", if(OperationCount >= 50 or DistinctOperations >= 4, "Medium", "Low")) as RiskScore

rule t1591_gather_victim_org_information {
  meta:
    author = "df00tech"
    description = "Detects bulk Azure AD org enumeration via Microsoft Graph API"
    mitre_attack_tactic = "TA0043"
    mitre_attack_technique = "T1591"
    confidence = "medium"
    severity = "high"
  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_name = "Azure Active Directory"
    $e.target.resource.name = /Get users|List users|Get groups|List groups|Get members|Get organization|Get directoryRoles/
    $e.security_result.action = "ALLOW"
  match:
    $e.principal.user.userid over 1h
  condition:
    #e > 30
}

#event_simpleName in ["UserLogon", "UserIdentityUpdate"]
| UserName = /./
| groupBy([UserName, RemoteAddressIP4], function=count(as=EventCount))
| EventCount > 30
| case {
    EventCount >= 100 => TechniqueLabel := "T1591 - OrgEnum - High";
    EventCount >= 50 => TechniqueLabel := "T1591 - OrgEnum - Medium";
    * => TechniqueLabel := "T1591 - OrgEnum - Low"
  }
| table([@timestamp, UserName, RemoteAddressIP4, EventCount, TechniqueLabel])