Add Entra ID identity attack rules: TAP creation, guest-to-member promotion, OAuth redirect URI (3 rules)

[descambiado]

Summary

Three new detection rules for Entra ID identity attack techniques with no existing coverage in the azure integration ruleset. All three target operations that produce no role assignment events and no new app registration events — the categories most commonly monitored — making them effective at evading standard detection logic.

Rules

persistence_entra_id_temporary_access_pass_created.toml — T1556.006, T1098 — High
Detects Create Temporary Access Pass method for user and Admin registered security info operations where a TAP is provisioned. A TAP is a time-limited passcode that bypasses all MFA factors including FIDO2 and certificate-based auth. An attacker with User Administrator or Authentication Administrator can issue one for any target account, sign in without the current password, and register persistent authentication methods before expiry. Steady-state TAP creation frequency is near zero in most tenants.

persistence_entra_id_guest_account_promoted_to_member.toml — T1098 — Medium
Detects Update user events where the UserType property changes from Guest to Member. The conversion grants the account full directory read access, removes external-identity Conditional Access restrictions, and makes the account indistinguishable from an internal employee — without any role assignment event. An attacker who compromises a guest account and promotes it gains persistent tenant access that survives Conditional Access policies scoped to external identities.

persistence_entra_id_oauth_app_redirect_uri_modified.toml — T1528 — Medium
Detects Update application events where the ReplyUrls field changes. Adding an attacker-controlled redirect URI to an existing trusted application allows interception of OAuth authorization codes when users authenticate through that application's normal login flow. No new application registration is created; no consent event is generated. The attack hijacks an app that users have already consented to.

Verification

• Confirmed no existing coverage for these three techniques in rules/integrations/azure/
• All rules use data_stream.dataset: "azure.auditlogs" with index = ["logs-azure.auditlogs-*"]
• TOML format matches existing azure ruleset conventions (metadata, rule, threat sections)
• Tags follow existing naming: "Data Source: Microsoft Entra ID", "Data Source: Microsoft Entra ID Audit Logs"
• Each rule includes investigation guide, false positive analysis, and response steps

[cla-checker-service]

❌ Author of the following commits did not sign a Contributor Agreement:
6d9a2ac

Please, read and sign the above mentioned agreement if you want to contribute to this project