CISA releases tool to review Microsoft 365 post-compromise activity

Image: CISA

The Cybersecurity and Infrastructure Security Agency (CISA) has released a companion Splunk-based dashboard that helps review post-compromise activity in Microsoft Azure Active Directory (AD), Office 365 (O365), and Microsoft 365 (M365) environments.

CISA's new tool, dubbed Aviary, helps security teams visualize and analyze data outputs generated using Sparrow, an open-source PowerShell-based tool for detecting potentially compromised applications and accounts in Azure and Microsoft 365. 

Sparrow was created to help defenders hunt down threat activity after the SolarWinds supply-chain attack.

Aviary can assist with reviewing the PowerShell logs that Sparrow exports, including analyzing PowerShell mailbox sign-ins to check if the logins are legitimate actions.

It can also help investigate PowerShell usage for users with PowerShell in the environment and examine Sparrow's listed tenant's Azure AD domains to see if they have been modified.

How to use Aviary

To use Aviary, you have to go through the following steps:

• Ingest Sparrow logs (sourcetype=csv)
• Import Aviary .xml code into new Dashboard
• Point Aviary to Sparrow data using the index and host selection
• Review the output. Click any UserId field value to correlate activity by the Service Principal.

Recognized data sources from Sparrow include:

• AppUpdate_Operations_Export.csv
• AppRoleAssignment_Operations_Export.csv
• Consent_Operations_Export.csv
• Domain_List.csv
• Domain_Operations_Export.csv
• FileItems_Operations_Export.csv
• MailItems_Operations_Export.csv
• PSLogin_Operations_Export.csv
• PSMailbox_Operations_Export.csv
• SAMLToken_Operations_Export.csv
• ServicePrincipal_Operations_Export.csv

CISA encourages network defenders who want to use Aviary for a more straightforward analysis of Sparrow output to review the AA21-008A alert on detecting post-compromise malicious activity in Microsoft Cloud environments. 

Other SolarWinds malicious activity detection tools

Last month, CISA released CHIRP (short for CISA Hunt and Incident Response Program), a new Python-based forensics collection tool for detecting signs of SolarWinds hackers' activity on Windows operating systems.

Cybersecurity firm CrowdStrike released a detection tool similar to Sparrow named the CrowdStrike Reporting Tool for Azure (CRT). 

CrowdStrike's CRT tool helps admins analyze Azure environments to get a more accessible overview of what privileges are assigned to partners and third-party resellers.

FireEye also published a free tool dubbed Azure AD Investigator for discovering artifacts indicating malicious activity by the state-backed threat actor behind the SolarWinds supply-chain attack.

These tools were developed and publicly released after Microsoft disclosed how stolen credentials and access tokens were being used by threat actors to target Azure customers.