{
    "Name": "Hybrid Attack - Cloud & Identity",
    "Author": "Microsoft - support@microsoft.com",
    "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\" width=\"75px\" height=\"75px\">",
    "Description": "This solution includes hunting queries for hybrid attack scenarios spanning on-premises, cloud, and identity environments. The queries are designed to detect multi-stage attack techniques that leverage both cloud and identity signals. By correlating activities across different domains, these hunting queries help security analysts identify complex attack patterns that may go unnoticed when looking at individual data sources in isolation.",
    "Hunting Queries": [
      "Hunting Queries/CredentialAccess/k8s-secret-enumeration-followed-by-exec.yaml",
      "Hunting Queries/CredentialAccess/k8s-token-audit-then-novel-cloud-control-plane.yaml",
      "Hunting Queries/CredentialAccess/keyvault-secret-read-then-partial-storage-exfil.yaml",
      "Hunting Queries/CredentialAccess/kv-harvest-spn-signin-then-out-of-scope-resource-access.yaml",
      "Hunting Queries/CredentialAccess/kv-secret-harvest-followed-by-novel-spn-signin-non1p-ip.yaml",
      "Hunting Queries/CredentialAccess/pod-cloud-cli-then-keyvault-storage-access.yaml",
      "Hunting Queries/DefenseEvasion/multi-service-network-exposure-followed-by-key-and-data-access.yaml",
      "Hunting Queries/DefenseEvasion/NetworkSecurityControlTampering.yaml",
      "Hunting Queries/DefenseEvasion/novel-spn-signin-followed-by-rbac-write.yaml",
      "Hunting Queries/DefenseEvasion/pod-token-tooling-then-cloud-rbac-write.yaml",
      "Hunting Queries/DefenseEvasion/suspicious-signin-followed-by-cloud-network-exposure-writes.yaml",
      "Hunting Queries/Discovery/cross-subscription-and-rg-enumeration-sweep.yaml",
      "Hunting Queries/Discovery/iam-enumeration-followed-by-keyvault-operations.yaml",
      "Hunting Queries/Discovery/iam-recon-followed-by-role-assignment-write.yaml",
      "Hunting Queries/Discovery/identity-app-enum-followed-by-noninteractive-novel-tuple.yaml",
      "Hunting Queries/Discovery/keyvault-discovery-followed-by-datastore-enumeration.yaml",
      "Hunting Queries/Discovery/novel-signin-followed-by-iam-recon-burst.yaml",
      "Hunting Queries/Discovery/oauth-consent-followed-by-firstseen-oauthappid-burst.yaml",
      "Hunting Queries/Exfiltration/EmailForwardingRuleToExternal.yaml",
      "Hunting Queries/Exfiltration/keyvault-secret-retrieval-followed-by-storage-key-auth-pivot.yaml",
      "Hunting Queries/Exfiltration/MultiMailboxAccessBySingleIP.yaml",
      "Hunting Queries/Exfiltration/novel-identity-followed-by-keyvault-secret-burst.yaml",
      "Hunting Queries/Exfiltration/partial-failures-then-read-concentration.yaml",
      "Hunting Queries/Exfiltration/StorageAccessFirstSeenExternalIP.yaml",
      "Hunting Queries/Exfiltration/StorageBulkDownloadAccountKeySAS.yaml",
      "Hunting Queries/Exfiltration/SuspiciousOAuthConsentSensitivePermissions.yaml",
      "Hunting Queries/InitialAccess/azure-vm-imds-token-theft-chain.yaml",
      "Hunting Queries/InitialAccess/CredentialStuffingSprayOnVPN3P.yaml",
      "Hunting Queries/InitialAccess/CVEExploitationOnNetworkAppliance3P.yaml",
      "Hunting Queries/InitialAccess/entra-app-credential-change-sp-signin-burst-chain.yaml",
      "Hunting Queries/InitialAccess/k8s-first-seen-control-plane-writer.yaml",
      "Hunting Queries/InitialAccess/PostAuthConfigChangeOnAppliance3P.yaml",
      "Hunting Queries/InitialAccess/rare-sp-signin-followed-by-rbac-write.yaml",
      "Hunting Queries/InitialAccess/RiskyVPNSignIn.yaml",
      "Hunting Queries/InitialAccess/TIMatchedIPOnNetworkAppliance.yaml",
      "Hunting Queries/InitialAccess/VPNCredentialStuffingAndSpray.yaml",
      "Hunting Queries/InitialAccess/web-service-child-process-egress.yaml",
      "Hunting Queries/LateralMovement/aad-connect-host-remote-admin-followed-by-entra-privilege-operation.yaml",
      "Hunting Queries/LateralMovement/entra-hybrid-user-signin-followed-by-onprem-lateral-movement.yaml",
      "Hunting Queries/LateralMovement/kerberoast-followed-by-cloud-signin.yaml",
      "Hunting Queries/LateralMovement/rdp-to-hybrid-device-followed-by-entra-access.yaml",
      "Hunting Queries/LateralMovement/wmi-remote-exec-on-hybrid-device-followed-by-cloud-signin.yaml",
      "Hunting Queries/Persistence/cloud-run-command-followed-by-kernel-persistence-indicators.yaml",
      "Hunting Queries/Persistence/appliance-mgt-session-followed-by-rbac-write.yaml",
      "Hunting Queries/Persistence/app-cred-change-sp-burst.yaml",
      "Hunting Queries/Persistence/FederatedIdentityProviderAddedToTenant.yaml",
      "Hunting Queries/Persistence/k8s-daemonset-cronjob-by-nonautomation-identity.yaml",
      "Hunting Queries/Persistence/MFAMethodAddedRiskyAccount.yaml",
      "Hunting Queries/Persistence/rare-kernel-load-signer-drift-followed-by-novel-ni-signin.yaml",
      "Hunting Queries/Persistence/rare-sp-auth-tuple.yaml",
      "Hunting Queries/Persistence/SecretAddedDormantServicePrincipal.yaml",
      "Hunting Queries/Persistence/service-principal-conditional-access-anomaly.yaml",
      "Hunting Queries/Persistence/sp-credential-change-followed-by-novel-sp-signin.yaml",
      "Hunting Queries/Persistence/suspicious-signin-followed-by-authmethod-or-role-change.yaml"
    ],
    "Workbooks": [
      "Workbooks/HybridAttack-Cloud&Identity.json"
    ],
    "WorkbooksDescription": "This workbook provides a comprehensive view of hybrid attack scenarios that span across cloud and identity environments. It aggregates data from various sources to help security analysts visualize and investigate potential threats, enabling them to identify complex attack patterns that may not be apparent when examining individual data sources in isolation.",
    "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Hybrid Attack - Cloud & Identity\\",
    "Version": "3.0.0",
    "Metadata": "SolutionMetadata.json",
    "TemplateSpec": true,
    "Is1PConnector": false
  }