Skip to main content
Lantern Home
 
 
Splunk Lantern

Detecting cloud federated credential abuse in Windows

  1. Last updated
  2. Save as PDF

 

You need to be able to detect events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktops or servers that provide federation services such as Windows Active Directory Federation Services. Identity federation relies on objects such as Oauth2 tokens, cookies, or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged, then attackers are able to pivot into your cloud environment.

This use case contains searches that detect abnormal processes which may indicate the extraction of federated directory objects such as passwords, Oauth2 tokens, certificates, and keys, as well as searches relating to specific O365 events.

Data required

How to use Splunk software for this use case

To deploy this use case, make sure that you have the Splunk ES Content Updates installed on your Splunk Enterprise Security deployment. This extensive content library empowers you to deploy out-of-the-box security detections and analytic stories to enhance your investigations and improve your security posture. If you do not have Splunk Enterprise Security, these detections will still give you an idea of what you can accomplish with SPL in the Splunk platform or with the free app, Splunk Security Essentials.

Some of the detections that can help you with this use case include:

Next steps

Splunk Enterprise Security provides other searches to help reinforce your cloud security posture, including:

Splunk OnDemand Services: Use these credit-based services for direct access to Splunk technical consultants with a variety of technical services from a pre-defined catalog. Most customers have OnDemand Services per their license support plan. Engage the ODS team at ondemand@splunk.com if you would like assistance.