Azure AD Certificate-Based Authentication Enabled via Authentication Methods Policy Update

title: Azure AD Certificate-Based Authentication Enabled via Authentication Methods Policy Update
id: d4148b9c-a43b-45f0-bc74-52f95c5b3ed7
status: test
description: This rule identifies Azure Active Directory tenant changes where the Authentication Methods policy is updated to enable certificate-based authentication. Attackers can use certificate-based authentication to establish persistent, passwordless access and maintain control even if other credentials are rotated or disabled. The detection relies on Azure audit log events capturing the Authentication Methods Policy Update operation and modifications to the AuthenticationMethodsPolicy property.
references:
  - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
  - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml
author: Harjot Shah Singh, '@cyb3rjy0t', Huntrule Team
date: 2024-03-26
tags:
  - attack.credential-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
  - attack.t1556
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName: Authentication Methods Policy Update
    TargetResources.modifiedProperties|contains: AuthenticationMethodsPolicy
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c2496b41-16a9-4016-a776-b23f8910dc58
    type: derived