Forge Web Credentials

let lookback = 7d;
let saml_spike_threshold = 5;
// Detection 1: High-volume or multi-geography SAML/WS-Fed token issuance (possible forged token replay)
let SamlAnomalies = AADSignInLogs
| where TimeGenerated > ago(lookback)
| where AuthenticationProtocol in ("saml20", "wsfed", "oauthpasswordgrant")
| where ResultType == 0
| extend GeoCountry = tostring(LocationDetails.countryOrRegion)
| extend IsCompliant = tostring(DeviceDetail.isCompliant)
| extend IsManagedDevice = tostring(DeviceDetail.isManaged)
| summarize
    SignInCount = count(),
    UniqueIPs = dcount(IPAddress),
    Countries = make_set(GeoCountry),
    Apps = make_set(AppDisplayName),
    IPList = make_set(IPAddress)
    by UserPrincipalName, AuthenticationProtocol, IsCompliant, IsManagedDevice, bin(TimeGenerated, 1h)
| where SignInCount > saml_spike_threshold or array_length(Countries) > 2 or UniqueIPs > 3
| extend RiskScore = case(
    array_length(Countries) > 3, 90,
    UniqueIPs > 5, 80,
    SignInCount > 20, 75,
    array_length(Countries) > 1 and IsCompliant == "false", 70,
    SignInCount > saml_spike_threshold, 50,
    40)
| extend AlertReason = strcat(
    "Suspicious SAML/federation token activity: ",
    SignInCount, " sign-ins from ",
    array_length(Countries), " countries, ",
    UniqueIPs, " IPs")
| project TimeGenerated, UserPrincipalName, AuthenticationProtocol, SignInCount,
    UniqueIPs, Countries, IPList, Apps, IsCompliant, IsManagedDevice, RiskScore, AlertReason;
// Detection 2: Federation configuration changes (pre-condition for Golden SAML)
let FedChanges = AuditLogs
| where TimeGenerated > ago(lookback)
| where OperationName in (
    "Set domain authentication",
    "Update domain",
    "Set federation settings on domain",
    "Add federated domain",
    "Set DirSyncEnabled flag",
    "Update StsRefreshTokensValidFrom Timestamp",
    "Update authorization policy")
| extend InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingApp = tostring(InitiatedBy.app.displayName)
| extend TargetResource = tostring(TargetResources[0].displayName)
| project TimeGenerated, OperationName, InitiatingUser, InitiatingApp, TargetResource, Result
| extend AlertReason = strcat("Federation configuration change: ", OperationName)
| extend RiskScore = 85;
// Detection 3: AWS STS token generation from suspicious principals (via Azure Sentinel AWS connector)
let AwsSts = CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor == "Amazon Web Services"
| where Activity in ("AssumeRole", "GetFederationToken", "AssumeRoleWithSAML", "AssumeRoleWithWebIdentity")
| where DeviceAction != "NOACTION"
| extend SourcePrincipal = tostring(extract("userName=([^,]+)", 1, AdditionalExtensions))
| extend RoleArn = tostring(extract("requestRoleArn=([^,]+)", 1, AdditionalExtensions))
| where SourcePrincipal !contains "i-" and SourcePrincipal !contains "AROA" // Exclude EC2 instance profiles
| project TimeGenerated, SourceIP, SourceUserName, Activity, DeviceAddress, RoleArn, AdditionalExtensions
| extend AlertReason = strcat("Suspicious AWS STS credential generation: ", Activity)
| extend RiskScore = 75;
union SamlAnomalies, FedChanges, AwsSts
| extend TechniqueId = "T1606"
| order by RiskScore desc, TimeGenerated desc

index=* (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| eval EventCode=coalesce(EventCode, event_id)
| search EventCode IN ("1", "4688")
| eval process_name=lower(coalesce(Image, NewProcessName, ""))
| eval command_line=coalesce(CommandLine, ProcessCommandLine, "")
| eval parent_process=lower(coalesce(ParentImage, ParentProcessName, ""))
| eval user=coalesce(User, SubjectUserName, "")
| eval hostname=coalesce(Computer, host)
| eval ts=strftime(_time, "%Y-%m-%d %H:%M:%S")
| eval risk_score=0
`comment("--- Credential forging framework detection ---")`
| eval risk_score=risk_score + if(match(command_line, "(?i)(AADInternals|Open-AzureOffice365Connection|ConvertTo-AADToken|Get-AADIntAccessToken|New-AADIntSAMLToken)"), 70, 0)
| eval risk_score=risk_score + if(match(command_line, "(?i)(golden[_\-\s]saml|shimit|ADFSpoof|samlReplay|Invoke-ADFSTokenSigning)"), 80, 0)
| eval risk_score=risk_score + if(match(command_line, "(?i)(Get-ADFSProperties|Export-PfxCertificate.*ADFS|Get-ADFSCertificate)"), 50, 0)
`comment("--- AWS STS credential forging via CLI ---")`
| eval risk_score=risk_score + if(match(command_line, "(?i)sts.*(assume-role-with-saml|get-federation-token|assume-role-with-web-identity)"), 60, 0)
`comment("--- Zimbra preauth key abuse ---")`
| eval risk_score=risk_score + if(match(command_line, "(?i)zmprov.*gdpak|zimbra.*preauth"), 55, 0)
`comment("--- JWT forgery patterns ---")`
| eval risk_score=risk_score + if(match(command_line, "(?i)(jwt.*forge|sign.*jwt|HS256.*secret|RS256.*privkey|none.*algorithm)"), 50, 0)
`comment("--- Suspicious parent process context ---")`
| eval risk_score=risk_score + if(match(process_name, "(?i)(powershell|pwsh)") AND match(parent_process, "(?i)(winword|excel|outlook|chrome|firefox|msedge)"), 25, 0)
| where risk_score >= 40
| eval detection_reason=case(
    match(command_line, "(?i)(AADInternals|golden[_\-\s]saml|ADFSpoof|samlReplay)"), "Known credential forging tool invocation",
    match(command_line, "(?i)Get-ADFSCertificate|Export-PfxCertificate.*ADFS"), "AD FS certificate extraction attempt",
    match(command_line, "(?i)sts.*(assume-role-with-saml|get-federation-token)"), "AWS STS federation token generation",
    match(command_line, "(?i)zmprov.*gdpak"), "Zimbra preauth key generation",
    1==1, "Credential forging behavioral pattern")
| stats count as event_count,
    max(risk_score) as max_risk,
    values(command_line) as command_lines,
    values(process_name) as processes,
    values(parent_process) as parent_processes,
    values(detection_reason) as reasons
    by hostname, user
| where max_risk >= 40
| eval severity=case(max_risk >= 70, "Critical", max_risk >= 50, "High", "Medium")
| sort - max_risk
| table hostname, user, severity, max_risk, event_count, reasons, processes, command_lines, parent_processes

any where event.dataset in ("azure.signinlogs", "o365.audit") and (kibana.alert.rule.name : "SAML*" or event.outcome : "success" and source.geo.country_iso_code != "US" and user_agent.name : ("python*", "curl*", "Go-http-client*")) or (event.action : "UserLoggedIn" and event.provider : "Exchange" and not user_agent.original : ("Microsoft*", "Mozilla*"))

SELECT username as "Username", sourceip as "SourceIP", devicetime as "EventTime", UTF8(payload) as "EventDetails", CASE WHEN UTF8(payload) ILIKE '%SAML%' AND UTF8(payload) ILIKE '%forged%' THEN 100 WHEN UTF8(payload) ILIKE '%Golden SAML%' OR UTF8(payload) ILIKE '%ADFSDump%' THEN 100 WHEN UTF8(payload) ILIKE '%token%' AND UTF8(payload) ILIKE '%unusual location%' THEN 70 ELSE 55 END as "RiskScore" FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Azure Active Directory', 'Microsoft Office 365', 'Microsoft Windows Security Event Log') AND (UTF8(payload) ILIKE '%SAML%' OR UTF8(payload) ILIKE '%token%' OR eventid IN (4769, 1007, 1200, 1202)) ORDER BY "RiskScore" DESC LAST 1 HOURS

_sourceCategory=azure/ad/signin OR _sourceCategory=o365/audit | json auto | where error_code in ("0", "50158", "50074", "50076") or event_action matches "*SAML*" or event_source matches "*ADFS*" | if(matches(event_action, "*ADFSSecretDump*") or matches(event_action, "*Golden SAML*"), "Critical", if(matches(error_code, "0") and !matches(user_agent, "*Microsoft*"), "High", "Medium")) as RiskLevel | stats count by user_principal_name, source_ip, RiskLevel | sort by count desc

rule detect_forge_web_credentials {
  meta:
    author = "Argus"
    description = "Detects forged web credential usage including SAML token abuse"
    severity = "HIGH"
    technique = "T1606"
  events:
    $e.metadata.event_type = "SSO"
    $e.metadata.product_name = "Microsoft Azure Active Directory"
    (
      $e.security_result.category = "POLICY_VIOLATION" or
      re.regex($e.principal.user.user_display_name, `.`) and
      not re.regex($e.principal.ip, `^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)`) 
    )
  condition:
    $e
}

#event_simpleName=UserLogon
| AuthenticationPackage = /SAML|Kerberos|NTLM/i
| LogonType = "3"
| case {
    UserSid = "S-1-5-18" | AccountType := "System";
    RemoteIP != "" | AccountType := "RemoteLogon";
    * | AccountType := "Unknown"
  }
| stats count(UserName) as LogonCount by UserName, RemoteIP, AuthenticationPackage
| where LogonCount > 10
| table([@timestamp, UserName, RemoteIP, AuthenticationPackage, LogonCount])