[Tests] Detecting Lateral Movement in Entra ID: Cross Tenant Synchronization

[fdicarlo]

Based on this article: https://www.xintra.org/blog/lateral-movement-entraid-cross-tenant-synchronization

I wrote few Pester tests, which hopefully covers the detection methodologies:

Describe "Entra ID Cross Tenant Synchronization Detection" {
    # Test 1: Check for anomalous admin user activity
    It "should detect anomalous activity by admin users" {
        $adminActivity = Get-AdminActivity -TenantID "YourTenantID"
        $anomalousActivity = $adminActivity | Where-Object { $_.Activity -match "SuspiciousPattern" }
        $anomalousActivity.Count | Should -BeGreaterThan 0
    }

    # Test 2: Validate cross-tenant access logs
    It "should validate cross-tenant access logs" {
        $accessLogs = Get-CrossTenantAccessLogs -TenantID "YourTenantID"
        $suspiciousAccess = $accessLogs | Where-Object { $_.SourceTenantID -ne "YourTenantID" -and $_.Activity -eq "Access" }
        $suspiciousAccess.Count | Should -BeGreaterThan 0
    }

    # Test 3: Detect unauthorized application permissions
    It "should detect unauthorized application permissions" {
        $appPermissions = Get-AppPermissions -TenantID "YourTenantID"
        $unauthorizedPermissions = $appPermissions | Where-Object { $_.Permissions -match "UnauthorizedPattern" }
        $unauthorizedPermissions.Count | Should -BeGreaterThan 0
    }

    # Test 4: Verify tenant synchronization settings
    It "should verify tenant synchronization settings" {
        $syncSettings = Get-TenantSyncSettings -TenantID "YourTenantID"
        $unexpectedSettings = $syncSettings | Where-Object { $_.Setting -match "UnexpectedPattern" }
        $unexpectedSettings.Count | Should -Be 0
    }
}

In these tests:

• Replace "YourTenantID" with the actual tenant ID.
• The Get-AdminActivity, Get-CrossTenantAccessLogs, Get-AppPermissions, and Get-TenantSyncSettings cmdlets should be replaced with the actual cmdlets or functions used in your environment to retrieve these logs and settings.
• Adjust the "SuspiciousPattern", "UnauthorizedPattern", and "UnexpectedPattern" with the actual patterns you are looking for based on the detection methodology.

I hope they can help secure our tenants.

[merill]

Tx @fdicarlo I'll move this to discussion.