Sentinel Queries

This project provides a series of KQL queries to detect abuse behaviors related to the BloodHound BARK toolkit in Azure AD tenants. These queries aim to identify behaviors simulated by BARK rather than the use of the tool itself. The content includes detection queries for different BARK functions, control suggestions, and relevant resource links.

Security Cloud platform #Azure Security #Threat Detection #Privilege Management #KQL Queries

rating : 2 points

downloads : 14

update time : 2025-04-23

What is BARK Detection?

These detection queries help identify suspicious activities in Azure AD that could indicate privilege escalation attempts, similar to what the BARK toolkit can perform. They monitor for actions like password resets, credential additions, role assignments and other sensitive operations.

How to Use These Detections?

The queries should be run in Microsoft Sentinel or Log Analytics against your Azure AD logs. It's recommended to first test them in your environment to tune for accuracy.

When to Use These Detections?

Use these queries for continuous monitoring of your Azure AD environment, especially if you have privileged users/service principals or want to detect potential compromise.

Key Detection Capabilities

Password Reset DetectionIdentifies password reset operations performed via PowerShell which could indicate compromise.

Application Secret CreationDetects when new credentials are added to application objects.

Role Assignment MonitoringTracks when users or service principals are added to privileged roles.

Ownership ChangesMonitors for changes to owners of applications and service principals.

Strengths and Limitations

Strengths

Provides visibility into potential privilege escalation paths

Covers both user and service principal activities

Uses native Azure AD logs requiring no additional instrumentation

Helps detect abuse of legitimate tools and permissions

Limitations

May generate false positives in environments with legitimate automation

Requires tuning to match your specific environment

Only detects actions after they occur (not preventive)

Some legitimate admin activities may appear similar to malicious ones

Implementation Guide

Set up logging

Ensure Azure AD logs are being collected in your Log Analytics workspace.

Test queries

Run the detection queries against your environment to establish baselines.

Create alerts

Configure alerts for suspicious activities in Microsoft Sentinel.

Implement controls

Apply the recommended prevention controls from the documentation.

Detection Scenarios

Detecting Application Secret CreationMonitoring when new credentials are added to applications, which could allow attackers to persist in the environment.

Identifying Suspicious Role AssignmentsDetecting when service principals are added to privileged roles, which could indicate privilege escalation.

Frequently Asked Questions

Are these queries specific to the BARK toolkit?

How often should I run these detection queries?

What permissions do I need to use these detections?

How can I reduce false positives?

Additional Resources

BloodHound BARK GitHub

The official BARK toolkit repository

Azure AD Privilege Escalation Detection

Blog post on detecting Azure AD privilege escalation

Microsoft Azure AD Documentation

Official Microsoft documentation for Azure Active Directory

🚀 BARK

BARK is a tool for detecting potential privilege escalation attacks in Azure Active Directory (Azure AD). It analyzes audit logs in Microsoft Sentinel to identify abnormal or high - risk activities.

🚀 Quick Start

This README provides detailed information about BARK, including its introduction, various detection queries, and control/prevention methods.

✨ Features

Analyze audit logs in Microsoft Sentinel to detect potential privilege escalation attacks in Azure AD.
Provide multiple detection queries based on different actor - target combinations.

💻 Usage Examples

Basic Usage

Detection Query (User as Actor, User as Target)

AuditLogs
| where OperationName == "Add member to group"
| extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| extend ['Actor IP Address'] = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
| extend GroupName = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))
| where TargetResources[0].type == "User"
| extend Target = tostring(TargetResources[0].userPrincipalName)
| where GroupName in~ ("PrivilegedGroup1","PrivilegedGroup2")
| project TimeGenerated, OperationName, Actor, ['Actor IP Address'], Target, GroupName

Detection Query (User as Actor, Service Principal as Target)

AuditLogs
| where OperationName == "Add member to group"
| extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| extend ['Actor IP Address'] = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
| extend GroupName = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))
| where TargetResources[0].type == "ServicePrincipal"
| where GroupName in~ ("PrivilegedGroup1","PrivilegedGroup2")
| project TimeGenerated, OperationName, Actor, ['Actor IP Address'], ['Target Service Principal Name'], ['Target Service Principal ObjectId'], GroupName

Detection Query (Service Principal as Actor, User as Target)

AuditLogs
| where OperationName == "Add member to group"
| extend ['Actor Service Principal Name'] = tostring(parse_json(tostring(InitiatedBy.app)).displayName)
| extend ['Actor Service Principal ObjectId'] = tostring(parse_json(tostring(InitiatedBy.app)).servicePrincipalId)
| where isnotempty(['Actor Service Principal ObjectId'])
| where ['Actor Service Principal Name'] != "MS - PIM"
| where TargetResources[0].type == "User"
| where GroupName in~ ("PrivilegedGroup1","PrivilegedGroup2")
| extend Target = tostring(TargetResources[0].userPrincipalName)
| project TimeGenerated, OperationName, ['Actor Service Principal Name'], ['Actor Service Principal ObjectId'], Target, GroupName

Detection Query (Service Principal as Actor, Service Principal as Target)

AuditLogs
| where OperationName == "Add member to group"
| extend ['Actor Service Principal Name'] = tostring(parse_json(tostring(InitiatedBy.app)).displayName)

🔧 Technical Details

The detection queries are designed to monitor the "Add member to group" operation in Azure AD audit logs. By filtering different actor - target combinations and specific group names, potential privilege escalation attacks can be detected.