Add device-code-theft correlation and admin-confirmed-compromise rules - #712
Merged
Conversation
9870102 requires properties.result=="success" and a DESKTOP-* hostname
pcre to catch rogue device registration -- both proved non-generalizable
across two real incidents (aarias01 2026-08-05: python-requests UA,
DESKTOP-DXV2C0PN, join blocked; ssmith02 2026-08-26: standard Dsreg UA,
AB-386-PRT, join also blocked). Neither incident's failed join would
have matched 9870102 as written.
Rather than widen 9870102's content match, add a flexbit correlation
chain that keys off session identity instead of content:
- 5017986 (azureEventHub_entra.rules): duplicates 5017933's proven
match conditions and sets a `device_code_theft` flexbit (noalert,
by_src on .callerIpAddress, 3600s) alongside it. 5017933 itself is
untouched.
- 9870107 (azure-eventhub-ad.rules, [EXPERIMENTAL] pending field
validation): fires on any "Register device" op -- regardless of
result or hostname -- gated on that flexbit. 9870102 itself is
untouched.
Both new rules validated via `sagan -T` against the compiled engine
binary (~/github/sagan/src/sagan) -- clean load, zero errors.
Not yet done: live fire-through replay of the flexbit chain against
the aarias01/ssmith02 telemetry (needs Redis for flexbit persistence).
Ref: QIS-508, ~/sc-engine/logs/bg_compromise/{aarias01,ssmith02}-device-code-attack-report.md
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D8Sa2QJf612vG3DttWE4uT
…lation Add flexbit-correlated device-join detection for device-code token theft
Detects ConfirmAccountCompromised in Entra AuditLogs. No IP field exists on this event type, so no parse_src_ip/threshold-by-IP is applicable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8Sa2QJf612vG3DttWE4uT
…ed-rule Add rule for admin-confirmed compromised account via Identity Protection
…g fix Brings in c2d2e45 (by_dst->by_src/1hr->1day fix for sid:9870000, and the xbits->flexbits noalert fix for sid:9870007/5017969) that landed upstream independently of this fork, ahead of local main. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8Sa2QJf612vG3DttWE4uT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
covers sid:9870107 (device-registration attempt following device-code refresh token theft, flexbit-correlated with 5017986) and sid:5017987 (admin-confirmed compromised account via Identity Protection)