Sparrow.ps1: Free Azure/Microsoft 365 incident response tool

Because of the growing popularity and adoption of cloud computing including software-as-a-service (SaaS) applications amongst consumers and organizations, there has been an increasing number of attacks involving Microsoft Office 365 and the Azure Active Directory environment, stemming from phishing attacks, business email compromise, supply-chain attacks and more. 

In January 2021, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) released an alert, warning the public that the advanced persistent threat (APT) actors behind the SolarWinds attack are leveraging attack vectors such as credential stuffing, brute-force attacks and more to gain access to organizations’ cloud resources. 

To this effect, CISA has developed a free tool — Sparrow — which can be used to detect malicious activities in an Azure/Microsoft Office 365 environment. 

Learn Incident Response

Get hands-on experience with incident response tools and techniques as you progress through nine courses.

Get Started

What is Sparrow.ps1?

Sparrow is a PowerShell tool developed by CISA’s Cloud Forensics team to detect malicious activities such as possibly compromised accounts and applications in the Azure or Microsoft Office 365 environment. The tool was developed due to the increased number of identity and authentication-based attacks on Azure and Microsoft Office 365 detected in multiple sectors recently. 

The tool can be used by network security analysts and incident responders and is focused on modules that are specific to recent attacks on federated identity sources and applications. It works identifying indicators of compromise (IoCs) associated with the recent attacks

The tool which was made available for public use can be found on CISA’s GitHub page. 

How does Sparrow.ps1 work?

When deployed, Sparrow will do the following:

1. Check and install the required PowerShell modules (ExchangeOnlineManagement, AzureAD and MSOnline).
2. Check the unified audit logs in Azure and Microsoft Office 365 for certain IoCs.
3. List Azure AD domains. 
4. Check Azure service principles and their Microsoft Graph API permissions to identify potentially malicious activities. 

Sparrow can be used for the following:

1. Detect modifications to the domain and federation settings on the tenant’s Azure AD domains. 
2. Detect modifications of service principles and application credentials by creating a timeline for all credential changes. 
3. Detect privilege escalation such as elevating the privileges/permissions of service principles, user or group. 
4. Detect OAuth’s consent and users’ consent to applications.
5. Identify anomalous Security Assertion Markup Language (SAML) token sign-ins in the unified audit log (filtering on user authentication value = 16457).
6. Review the PowerShell logs (focusing on mailbox sign-ins and PowerShell usage) exported by Sparrow. 
7. Review the Graph API application permissions of all service principles and applications. 
8. Review MailItemsAccessed for application IDs used in accessing users’ mailboxes.

Sparrow requirements

Before installing and running Sparrow in your Microsoft O365 and Azure environment, you need the following permissions:

1. Azure Active Directory — security reader
2. Security and Compliance Center — compliance administrator
3. Exchange Online Admin Center: You need a create a custom group with these specific permissions:
1. Mail recipients
2. Security group creation and membership
3. User options
4. View-only audit log
5. View-only configuration
6. View-only recipients

To be able to check MailItemsAccessed, your tenant needs to have an Office 365 or Microsoft 365 E5/G5 license. 

Unified audit logs need to be enabled. 

Learn Incident Response

Get hands-on experience with incident response tools and techniques as you progress through nine courses.

Get Started

Sparrow: Practical applications

After deploying Sparrow in your IT environment, you should do the following:

1. Audit the creation, use and modifications of service principles and applications by looking for unusual application usage or assignment of credentials to applications that allow non-interactive sign-in by the application.
2. Look for unexpected trust relationships that have been added to Azure AD (including non-interactive sign-ins).
3. Audit login details of administrative accounts (including unusual sign-in locations, dates, times, number of attempts and others).
4. Review unauthorized changes to token validation periods (especially those with high values).
5. Review OAuth consents and consents made to applications. 
6. Review instances of excessive-high permissions including but not limited to Exchange Online, Microsoft Graph and Azure AD Graph. 
7. Identify manipulation of custom or third-party applications in the Azure tenant. 
8. Review permissions of application in Microsoft O365 and Azure AD. 

Sources

CISA Gov, GitHub

CISA, Alert (AA21-008A)