Specialists from Cybersecurity and Infrastructure Security Agency (CISA) announced the launch of a companion dashboard based on the Splunk tool that will help administrators verify security in Microsoft Azure Active Directory, Office 365, and Microsoft 365 environments.
Identify as Aviary, this tool will help analyze the outputs of data generated with the PowerShell-based open source tool known as Sparrow, useful for detecting potentially compromised Azure and Microsoft 365 applications and accounts.
Experts point out that Aviary can be of great help in reviewing the PowerShell logs detected by Sparrow, including login analysis. Administrators can also help investigate the use of PowerShell for users in their environment and examine Azure AD domains.
The following are the main steps to use Aviary:
- Ingest Sparrow logs (sourcetype s csv)
- Import Aviary .xml code into a new Control Panel
- Point Aviary data at Sparrow using index and host selection
- Review the result. Click any UserId field value to correlate service principal activity
Sparrow’s recognized data sources include:
- AppUpdate_Operations_Export.csv
- AppRoleAssignment_Operations_Export.csv
- Consent_Operations_Export.csv
- Domain_List.csv
- Domain_Operations_Export.csv
- FileItems_Operations_Export.csv
- MailItems_Operations_Export.csv
- PSLogin_Operations_Export.csv
- PSMailbox_Operations_Export.csv
- SAMLToken_Operations_Export.csv
- ServicePrincipal_Operations_Export.csv
The Agency recommends that administrators of these deployments use Aviary to perform simple analysis of Sparrow’s output, reviewing the AA21-008A alert about post-compromise malicious activity detection in Microsoft Cloud environments.
A few weeks ago CISA launched CHIRP, a Python-based forensic collection tool to detect signs of malicious activity similar to SolarWinds attacks on Windows operating systems. On the other hand, CrowdStrike launched a Sparrow-like discovery tool called CrowdStrike Reporting Tool for Azure.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
