Exploitation for Privilege Escalation `T1404`

Mobile Tactic: Privilege Escalation

Authoring guide

These 1 rule share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EntityName`	1	`eq` 1	`role`, `systemuser`
`Message`	1	`eq` 1	`Associate`, `Create`, `Delete`
`Name`	1	`eq` 1	`name`, `role`, `roleid`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EntityName`	`eq`	`role` kustoDataverse - Suspicious security role modifications	1
`EntityName`	`eq`	`systemuser` kustoDataverse - Suspicious security role modifications	1	3
`Message`	`eq`	`Associate` kustoDataverse - Suspicious security role modifications	1
`Message`	`eq`	`Create` kustoDataverse - Suspicious security role modifications	1	2
`Message`	`eq`	`Delete` kustoDataverse - Suspicious security role modifications	1	2
`Message`	`eq`	`Disassociate` kustoDataverse - Suspicious security role modifications	1
`Name`	`eq`	`name` kustoDataverse - Suspicious security role modifications	1
`Name`	`eq`	`role` kustoDataverse - Suspicious security role modifications	1
`Name`	`eq`	`roleid` kustoDataverse - Suspicious security role modifications	1

These vendors publish rules tagged with this technique.

Platform: Microsoft 365

Domain: SaaS