Description

Add coverage for TeamFiltration tool via unique user-agent string that is hardcoded when doing enumerations and password spraying.

Target Ruleset

azure

Target Rule Type

None

Tested ECS Version

No response

Query

event.dataset: azure.signinlogs and user_agent.name: "Electron" and user_agent.os.name: "Windows" and azure.signinlogs.properties.app_id: "1fec8e78-bce4-4aaf-ab1b-5451cc387264"" 

New fields required in ECS/data sources for this rule?

No response

Related issues or PRs

• https://github.com/elastic/ia-trade-team/issues/653

References

• https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign
• https://github.com/Flangvik/TeamFiltration

Redacted Example Data

No response