Sunturai
Back to results
MediumSplunk security contentdescambiado

Azure AD Temporary Access Pass Created

The following analytic detects the creation of a Temporary Access Pass (TAP) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user"…

Description

The following analytic detects the creation of a Temporary Access Pass (TAP) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Create Temporary Access Pass method for user" operation. TAPs are time-limited passcodes that bypass all authentication requirements including MFA and FIDO2 - an attacker who creates a TAP for a compromised account can sign in from any location without any additional factor. If confirmed malicious, this activity provides an attacker with an unchallenged authentication path into the affected account.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderLinuxmacOSOffice SuitePRESaaSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
azure_active_directory

Known benign triggers

  • IT administrators legitimately create TAPs for users who are locked out or onboarding a new passwordless authentication method. The key differentiators are the actor and timing -- a helpdesk account creating a TAP for a user who just reported a lockout is expected; an unfamiliar actor creating a TAP outside business hours or for a high-privilege account warrants investigation.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice