MikeGPT CyberSecurity

# Conceptual Configuration Guide for MojoAuth Risk-Based Authentication # Step 1: Define and Enable Risk Signals # In the MojoAuth admin console, navigate to Security -> Risk Engine. # Enable the following signals for analysis: # - IP Reputation (Threat intelligence feeds) # - Geolocation and Impossible Travel Detection # - Device Fingerprinting and New Device Detection # - User Behavior Analytics (UBA) # Step 2: Configure Risk Tiers # Define risk scores for different events. # - Low Risk (Score 0-30): Login from a registered device in a known location. # - Medium Risk (Score 31-70): Login from a new device or unfamiliar IP address. # - High Risk (Score 71-100): Login attempt from a known malicious IP or exhibiting impossible travel. # Step 3: Create Adaptive Access Policies # Navigate to Policies -> Access Policies and create rules based on risk. # - IF risk_score <= 30 THEN allow_access # - IF risk_score > 30 AND risk_score <= 70 THEN require_mfa(push_notification) # - IF risk_score > 70 THEN block_access AND alert(security_team) # Step 4: Monitor and Tune # Regularly review the risk engine dashboard for false positives/negatives. # Adjust risk scores and policies based on observed attacker TTPs and user feedback.

rule Detect_Suspicious_MS_Device_Code_Flow { meta: description = "Detects JavaScript patterns potentially used in watering hole attacks to abuse Microsoft's device code authentication flow, as seen in APT29 campaigns." author = "Threat Rundown" date = "2025-09-01" reference = "https://securityboulevard.com/?p=2068136" strings: $s1 = "device_code" $s2 = "login.microsoftonline.com" $s3 = "oauth2/v2.0/devicecode" $s4 = "user_code" $s5 = "verification_uri" condition: uint16(0) == 0x3c21 and filesize < 500KB and all of them }

// Splunk Query index=azuread sourcetype="azure:signin" | spath input=properties output=auth_method path=authenticationDetails{}.authenticationMethod | search auth_method="Device code" | iplocation properties.ipAddress | stats count by user, Country, City, properties.ipAddress, appDisplayName | eventstats avg(count) as avg_logins_per_user by user | where count > (avg_logins_per_user * 2) OR isnull(avg_logins_per_user) | sort - count | table user, Country, City, properties.ipAddress, appDisplayName, count

<# .SYNOPSIS Audits Azure AD Sign-in logs for authentications using the device code flow. .DESCRIPTION This script connects to Microsoft Graph and queries sign-in logs from the last 7 days to identify users and applications that have authenticated via the device code flow. Requires the Microsoft.Graph.Authentication and Microsoft.Graph.Reports modules. #> # Ensure required modules are installed if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) { Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force } if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Reports)) { Install-Module Microsoft.Graph.Reports -Scope CurrentUser -Force } Connect-MgGraph -Scopes "AuditLog.Read.All" Write-Host "Querying sign-in logs for device code flow authentications in the last 7 days..." -ForegroundColor Yellow $filterDate = (Get-Date).AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ") $filterString = "createdDateTime ge $($filterDate) and authenticationDetails/any(c:c/authenticationMethod eq 'Device code')" try { $signInEvents = Get-MgAuditLogSignIn -Filter $filterString -All if ($signInEvents) { $signInEvents | Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName, IPAddress, Location, DeviceDetail.OperatingSystem } else { Write-Host "No sign-in events using device code flow found in the last 7 days." -ForegroundColor Green } } catch { Write-Error "An error occurred while querying logs: $_" } Disconnect-MgGraph