Azure Event Hub Deletion for Defense Evasion

hello@craftedsignal.io — Tue, 09 Jan 2024 10:00:00 +0000

This alert identifies the deletion of an Azure Event Hub, a critical event processing service for ingesting and processing large volumes of data in real-time. Attackers may target Event Hubs for deletion in an attempt to evade detection by erasing evidence of their activities or to disrupt data flow. The rule focuses on identifying successful deletion operations within Azure activity logs, specifically looking for the "MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE" event. The monitoring of Event Hub deletion is crucial because successful deletion can lead to data loss, service disruption, and an increased dwell time for attackers due to the removal of forensic data.

Attack Chain

An attacker gains unauthorized access to an Azure account, potentially through compromised credentials or exploiting a vulnerability.
The attacker escalates privileges within the Azure environment to obtain the necessary permissions to manage Event Hubs.
The attacker identifies Event Hubs within the target environment that contain valuable log data.
The attacker initiates a deletion request for a specific Event Hub using the Azure portal, CLI, or API.
Azure processes the deletion request, logging the event with the operation name "MICROSOFT.EVENTHUB/NAMESPACES/EVENTHUBS/DELETE".
The Event Hub is successfully deleted, resulting in the removal of associated log data and potentially disrupting data streams.
The attacker attempts to cover their tracks by deleting or modifying other related logs within the Azure environment.

Impact

Successful deletion of Azure Event Hubs can lead to a significant loss of log data, hindering incident response and forensic investigations. This can allow attackers to operate undetected for longer periods, increasing the potential for further damage. Service disruption can also occur if the deleted Event Hub was critical for real-time data processing. While the exact number of victims is unknown, organizations relying on Azure Event Hubs for security monitoring and data analytics are at risk.

Recommendation

Deploy the Sigma rule to detect Event Hub deletions (see rules section) in your SIEM, and tune for your environment.
Review Azure RBAC permissions to ensure only authorized personnel have Event Hub deletion rights.
Enable multi-factor authentication (MFA) for all Azure accounts to prevent unauthorized access (reference: https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-about).
Implement additional monitoring and alerting for Azure Event Hub operations to detect and respond to unauthorized activities promptly.

Azure Event Hub Authorization Rule Created or Updated

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

The creation or modification of Azure Event Hub authorization rules can be an indicator of malicious activity. Event Hub authorization rules manage access via cryptographic keys, similar to administrative credentials. Attackers may target these rules to gain unauthorized access or escalate privileges, potentially leading to data exfiltration or other malicious actions within the Azure environment. The default RootManageSharedAccessKey rule, created with each Event Hub namespace, provides administrative access and is a particularly attractive target. This activity is detected via Azure Activity Logs, providing insight into potential misuse of these powerful access controls. The rule monitors for successful creation or modification events.

Attack Chain

An attacker gains initial access to an Azure account, possibly through compromised credentials or an exposed service principal.
The attacker enumerates existing Event Hub namespaces within the Azure subscription to identify potential targets.
The attacker attempts to create a new authorization rule with elevated privileges (e.g., manage permissions) on a target Event Hub namespace.
Alternatively, the attacker modifies an existing authorization rule, such as adding or changing the associated cryptographic keys.
The attacker uses the newly created or modified authorization rule to generate a Shared Access Signature (SAS) token.
The SAS token is then used to authenticate to the Event Hub and perform unauthorized actions, such as reading or writing event data.
The attacker exfiltrates sensitive data from the Event Hub using the compromised authorization rule.

Impact

A successful attack leveraging unauthorized Event Hub authorization rule modification can lead to significant data breaches and operational disruption. The severity depends on the sensitivity of the data within the Event Hubs. A compromised RootManageSharedAccessKey could grant an attacker full control over the Event Hub namespace and its data. The impact can include exfiltration of sensitive data, denial of service, or further compromise of other Azure resources.

Recommendation

Deploy the Sigma rule "Azure Event Hub Authorization Rule Created or Updated" to your SIEM and tune for your environment to detect suspicious authorization rule modifications.
Review Azure Activity Logs (referenced in the rule) for unauthorized or unexpected creation or modification of Event Hub authorization rules, paying close attention to the user or service principal associated with the operation.
Implement conditional access policies to restrict access to Event Hub Authorization Rules based on user roles and network locations, as suggested in the overview.
Regularly rotate the cryptographic keys associated with Event Hub Authorization Rules, especially the RootManageSharedAccessKey, as outlined in the response recommendations.
Monitor for access patterns or data transfers from the affected Event Hubs following a rule change to detect potential data exfiltration, referencing the overview.

Azure Event Hub - CraftedSignal Threat Feed

Azure Event Hub Deletion for Defense Evasion

Attack Chain

Impact

Recommendation

Azure Event Hub Authorization Rule Created or Updated

Attack Chain

Impact

Recommendation