Azure AD audit: TrustedCAsForPasswordlessAuth root CA added via Set Company Information

title: "Azure AD audit: TrustedCAsForPasswordlessAuth root CA added via Set Company Information"
id: 9c3e52a0-1dd5-4ad1-a910-0bf86f8654d5
status: test
description: This rule flags Azure AD audit log events where the company information is updated to include new entries under TrustedCAsForPasswordlessAuth, indicating a new root certificate authority has been added. Attackers can use certificate-based authentication to establish or maintain access without traditional password methods. It relies on Azure AD audit log telemetry for OperationName "Set Company Information" and modified property values that contain the TrustedCAsForPasswordlessAuth setting.
references:
  - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
  - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml
author: Harjot Shah Singh, '@cyb3rjy0t', Huntrule Team
date: 2024-03-26
tags:
  - attack.credential-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1556
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName: Set Company Information
    TargetResources.modifiedProperties.newValue|contains: TrustedCAsForPasswordlessAuth
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4bb80281-3756-4ec8-a88e-523c5a6fda9e
    type: derived