CISA Releases Free Detection Tool for Azure/M365 Environment

ronjor · Dec 25, 2020

Original release date: December 24, 2020

CISA has created a free tool for detecting unusual and potentially malicious activity that threatens users and applications in an Azure/Microsoft O365 environment. The tool is intended for use by incident responders and is narrowly focused on activity that is endemic to the recent identity- and authentication-based attacks seen in multiple sectors.
CISA strongly encourages users and administrators to visit the following GitHub page for additional information and detection countermeasures.
Click to expand...

ronjor · Jan 8, 2021

CISA Releases New Alert on Post-Compromise Threat Activity in Microsoft Cloud Environments and Tools to Help Detect This Activity

Original release date: January 08, 2021
CISA has evidence of post-compromise advanced persistent threat (APT) activity in the cloud environment. Specifically, CISA has seen an APT actor using compromised applications in a victim’s Microsoft 365 (M365)/Azure environment and using additional credentials and Application Programming Interface (API) access to cloud resources of private and public sector organizations. This activity is in addition to what has been previously detailed in AA20-352A.
Click to expand...

In response, CISA has released AA21-008A: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments to describe this malicious APT activity and offer guidance on three open-source tools—including a CISA-developed tool, Sparrow, released on December 24. Network defenders can use these tools to help detect and remediate malicious APT actor activity as part of the ongoing supply chain compromise.
Click to expand...

CISA strongly encourages users and administrators to review the Activity Alert for additional information and detection countermeasures.
Click to expand...

ronjor · Apr 8, 2021

Using Aviary to Analyze Post-Compromise Threat Activity in M365 Environments

Original release date: April 08, 2021
Aviary is a new dashboard that CISA and partners developed to help visualize and analyze outputs from its Sparrow detection tool released in December 2020. Sparrow helps network defenders detect possible compromised accounts and applications in Azure/Microsoft O365 environments. CISA created Sparrow to support hunts for threat activity following the SolarWinds compromise.
Click to expand...

Aviary—a Splunk-based dashboard—facilitates analysis of Sparrow data outputs.
CISA encourages network defenders wishing to use Aviary to facilitate their analysis of output from Sparrow to review CISA Alert: AA21-008A: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments. Note: CISA has updated the Sparrow tool section of AA21-008A with instructions on using the Aviary tool.
Click to expand...

Log in or Sign up

CISA Releases Free Detection Tool for Azure/M365 Environment

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Log in or Sign up

CISA Releases Free Detection Tool for Azure/M365 Environment

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

Useful Searches