DO NOT MERGE draft PR

Solutions/Azure Activity/Analytic Rules/SubscriptionMigration.yaml

@@ -7,6 +7,7 @@ description: |
   Once moved, threat actors may deploy resources and perform malicious activities such as crypto mining.
   This is a technique known as "subscription hijacking". More information can be found here: https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/hunt-for-compromised-azure-subscriptions-using-microsoft/ba-p/3607121'
 severity: Low
+status: Available
 requiredDataConnectors:
   - connectorId: AzureActivity
     dataTypes:

Solutions/Azure Activity/Data/Solution_AzureActivity.json

@@ -3,7 +3,7 @@
   "Author": "Microsoft - support@microsoft.com",
   "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/azureactivity_logo.svg\" width=\"75px\" height=\"75px\">",
   "Description": "The [Azure Activity](https://docs.microsoft.com/azure/azure-monitor/essentials/activity-log) solution for Microsoft Sentinel enables you to ingest Azure Activity Administrative, Security, Service Health, Alert, Recommendation, Policy, Autoscale and Resource Health [logs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) using Diagnostic Settings into Microsoft Sentinel.",
- "Data Connectors": [
+  "Data Connectors": [
     "Data Connectors/AzureActivity.json"
   ],
   "Hunting Queries": [
@@ -21,7 +21,7 @@
     "Hunting Queries/Granting_Permissions_to_Account.yaml",
     "Hunting Queries/PortOpenedForAzureResource.yaml",
     "Hunting Queries/Rare_Custom_Script_Extension.yaml",
-	"Hunting Queries/Machine_Learning_Creation.yaml"
+    "Hunting Queries/Machine_Learning_Creation.yaml"
   ],
   "Analytic Rules": [
     "Analytic Rules/AADHybridHealthADFSNewServer.yaml",
@@ -30,25 +30,40 @@
     "Analytic Rules/Creating_Anomalous_Number_Of_Resources_detection.yaml",
     "Analytic Rules/Creation_of_Expensive_Computes_in_Azure.yaml",
     "Analytic Rules/Granting_Permissions_To_Account_detection.yaml",
+    "Analytic Rules/Machine_Learning_Creation.yaml",
     "Analytic Rules/NRT-AADHybridHealthADFSNewServer.yaml",
     "Analytic Rules/NRT_Creation_of_Expensive_Computes_in_Azure.yaml",
     "Analytic Rules/New-CloudShell-User.yaml",
     "Analytic Rules/NewResourceGroupsDeployedTo.yaml",
     "Analytic Rules/RareOperations.yaml",
-    "Analytic Rules/TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml",
-	"Analytic Rules/SubscriptionMigration.yaml",
-	"Analytic Rules/Machine_Learning_Creation.yaml"
-
+    "Analytic Rules/SubscriptionMigration.yaml",
+    "Analytic Rules/TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml"
   ],
   "Workbooks": [
     "Workbooks/AzureActivity.json",
     "Workbooks/AzureServiceHealthWorkbook.json"
   ],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\solutions\\Azure Activity",
-  "Version": "3.0.4",
   "Metadata": "SolutionMetadata.json",
   "TemplateSpec": true,
   "StaticDataConnectorIds": [
     "AzureActivity"
-  ]
-}
+  ],
+  "XDR Detections": [
+    "XDR Detections/AADHybridHealthADFSNewServer.yaml",
+    "XDR Detections/AADHybridHealthADFSServiceDelete.yaml",
+    "XDR Detections/AADHybridHealthADFSSuspApp.yaml",
+    "XDR Detections/Creating_Anomalous_Number_Of_Resources_detection.yaml",
+    "XDR Detections/Creation_of_Expensive_Computes_in_Azure.yaml",
+    "XDR Detections/Granting_Permissions_To_Account_detection.yaml",
+    "XDR Detections/Machine_Learning_Creation.yaml",
+    "XDR Detections/NRT-AADHybridHealthADFSNewServer.yaml",
+    "XDR Detections/NRT_Creation_of_Expensive_Computes_in_Azure.yaml",
+    "XDR Detections/New-CloudShell-User.yaml",
+    "XDR Detections/NewResourceGroupsDeployedTo.yaml",
+    "XDR Detections/RareOperations.yaml",
+    "XDR Detections/SubscriptionMigration.yaml",
+    "XDR Detections/TimeSeriesAnomaly_Mass_Cloud_Resource_Deletions.yaml"
+  ],
+  "Version": "3.1.2"
+}

Solutions/Azure Activity/Hunting Queries/Machine_Learning_Creation.yaml

@@ -43,4 +43,4 @@ entityMappings:
       - identifier: ResourceId
         columnName: _ResourceId
 
-version: 1.0
+version: "1.0"

Solutions/Azure Activity/Package/createUiDefinition.json

@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/azureactivity_logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Activity/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Azure Activity](https://docs.microsoft.com/azure/azure-monitor/essentials/activity-log) solution for Microsoft Sentinel enables you to ingest Azure Activity Administrative, Security, Service Health, Alert, Recommendation, Policy, Autoscale and Resource Health [logs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) using Diagnostic Settings into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 2, **Analytic Rules:** 14, **Hunting Queries:** 15\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Workbooks/Images/Logos/azureactivity_logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Azure%20Activity/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Azure Activity](https://docs.microsoft.com/azure/azure-monitor/essentials/activity-log) solution for Microsoft Sentinel enables you to ingest Azure Activity Administrative, Security, Service Health, Alert, Recommendation, Policy, Autoscale and Resource Health [logs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) using Diagnostic Settings into Microsoft Sentinel.\n\n**Data Connectors:** 1, **Workbooks:** 2, **Analytic Rules:** 14, **XDR Detections:** 14, **Hunting Queries:** 15\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -51,6 +51,47 @@
       }
     ],
     "steps": [
+      {
+        "name": "contentSelection",
+        "label": "Content selection",
+        "elements": [
+          {
+            "name": "DeployAnalyticsRule",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployAnalyticsRule",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)."
+          },
+          {
+            "name": "DeployWorkbook",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployWorkbook",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)."
+          },
+          {
+            "name": "DeployDataConnector",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployDataConnector",
+            "defaultValue": true,
+            "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)."
+          },
+          {
+            "name": "DeployCustomDetection",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployCustomDetection",
+            "defaultValue": false,
+            "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch."
+          },
+          {
+            "name": "DeployHuntingQuery",
+            "type": "Microsoft.Common.CheckBox",
+            "label": "DeployHuntingQuery",
+            "defaultValue": true,
+            "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution."
+          }
+        ]
+      },
       {
         "name": "dataconnectors",
         "label": "Data Connectors",
@@ -244,83 +285,83 @@
           {
             "name": "analytic7",
             "type": "Microsoft.Common.Section",
-            "label": "NRT Microsoft Entra ID Hybrid Health AD FS New Server",
+            "label": "Azure Machine Learning Write Operations",
             "elements": [
               {
                 "name": "analytic7-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "This detection uses AzureActivity logs (Administrative category) to identify the creation or update of a server instance in an Microsoft Entra ID Hybrid Health AD FS service.\nA threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-premises AD FS server.\nThis can be done programmatically via HTTP requests to Azure. More information in this blog: https://o365blog.com/post/hybridhealthagent/"
+                  "text": "Shows the most prevalent users who perform write operations on Azure Machine Learning resources. List the common source IP address for each of those accounts. If an operation is not from those IP addresses, it may be worthy of investigation."
                 }
               }
             ]
           },
           {
             "name": "analytic8",
             "type": "Microsoft.Common.Section",
-            "label": "NRT Creation of expensive computes in Azure",
+            "label": "NRT Microsoft Entra ID Hybrid Health AD FS New Server",
             "elements": [
               {
                 "name": "analytic8-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Identifies the creation of large size or expensive VMs (with GPUs or with a large number of virtual CPUs) in Azure.\nAn adversary may create new or update existing virtual machines to evade defenses or use them for cryptomining purposes.\nFor Windows/Linux Vm Sizes, see https://docs.microsoft.com/azure/virtual-machines/windows/sizes \nAzure VM Naming Conventions, see https://docs.microsoft.com/azure/virtual-machines/vm-naming-conventions"
+                  "text": "This detection uses AzureActivity logs (Administrative category) to identify the creation or update of a server instance in an Microsoft Entra ID Hybrid Health AD FS service.\nA threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-premises AD FS server.\nThis can be done programmatically via HTTP requests to Azure. More information in this blog: https://o365blog.com/post/hybridhealthagent/"
                 }
               }
             ]
           },
           {
             "name": "analytic9",
             "type": "Microsoft.Common.Section",
-            "label": "New CloudShell User",
+            "label": "NRT Creation of expensive computes in Azure",
             "elements": [
               {
                 "name": "analytic9-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Identifies when a user creates an Azure CloudShell for the first time.\nMonitor this activity to ensure only the expected users are using CloudShell."
+                  "text": "Identifies the creation of large size or expensive VMs (with GPUs or with a large number of virtual CPUs) in Azure.\nAn adversary may create new or update existing virtual machines to evade defenses or use them for cryptomining purposes.\nFor Windows/Linux Vm Sizes, see https://docs.microsoft.com/azure/virtual-machines/windows/sizes \nAzure VM Naming Conventions, see https://docs.microsoft.com/azure/virtual-machines/vm-naming-conventions"
                 }
               }
             ]
           },
           {
             "name": "analytic10",
             "type": "Microsoft.Common.Section",
-            "label": "Suspicious Resource deployment",
+            "label": "New CloudShell User",
             "elements": [
               {
                 "name": "analytic10-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Identifies when a rare Resource and ResourceGroup deployment occurs by a previously unseen caller."
+                  "text": "Identifies when a user creates an Azure CloudShell for the first time.\nMonitor this activity to ensure only the expected users are using CloudShell."
                 }
               }
             ]
           },
           {
             "name": "analytic11",
             "type": "Microsoft.Common.Section",
-            "label": "Rare subscription-level operations in Azure",
+            "label": "Suspicious Resource deployment",
             "elements": [
               {
                 "name": "analytic11-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "This query looks for a few sensitive subscription-level events based on Azure Activity Logs. For example, this monitors for the operation name 'Create or Update Snapshot', which is used for creating backups but could be misused by attackers to dump hashes or extract sensitive information from the disk."
+                  "text": "Identifies when a rare Resource and ResourceGroup deployment occurs by a previously unseen caller."
                 }
               }
             ]
           },
           {
             "name": "analytic12",
             "type": "Microsoft.Common.Section",
-            "label": "Mass Cloud resource deletions Time Series Anomaly",
+            "label": "Rare subscription-level operations in Azure",
             "elements": [
               {
                 "name": "analytic12-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "This query generates the baseline pattern of cloud resource deletions by an individual and generates an anomaly when any unusual spike is detected. These anomalies from unusual or privileged users could be an indication of a cloud infrastructure takedown by an adversary."
+                  "text": "This query looks for a few sensitive subscription-level events based on Azure Activity Logs. For example, this monitors for the operation name 'Create or Update Snapshot', which is used for creating backups but could be misused by attackers to dump hashes or extract sensitive information from the disk."
                 }
               }
             ]
@@ -342,13 +383,13 @@
           {
             "name": "analytic14",
             "type": "Microsoft.Common.Section",
-            "label": "Azure Machine Learning Write Operations",
+            "label": "Mass Cloud resource deletions Time Series Anomaly",
             "elements": [
               {
                 "name": "analytic14-text",
                 "type": "Microsoft.Common.TextBlock",
                 "options": {
-                  "text": "Shows the most prevalent users who perform write operations on Azure Machine Learning resources. List the common source IP address for each of those accounts. If an operation is not from those IP addresses, it may be worthy of investigation."
+                  "text": "This query generates the baseline pattern of cloud resource deletions by an individual and generates an anomaly when any unusual spike is detected. These anomalies from unusual or privileged users could be an indication of a cloud infrastructure takedown by an adversary."
                 }
               }
             ]
@@ -593,7 +634,12 @@
     "outputs": {
       "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
       "location": "[location()]",
-      "workspace": "[basics('workspace')]"
+      "workspace": "[basics('workspace')]",
+      "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]",
+      "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]",
+      "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]",
+      "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]",
+      "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]"
     }
   }
 }