O365 Recently Created Entra ID User Assigned Roles

// Copyright 2023 Google LLC. Licensed under Apache-2.0.

rule o365_recently_created_entra_id_user_assigned_roles {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a user is created in Entra ID and assigned roles within a defined time window."
    rule_id = "mr_c0406a96-4ed1-4dd2-9629-aa5a2c881222"
    rule_name = "O365 Recently Created Entra ID User Assigned Roles"
    tactic = "TA0003"
    technique = "T1098.003"
    assumption = "The list msgraph_watchlist_roles is populated with role names, ie Application Administrator"
    type = "alert"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    (
        $create.metadata.event_type = "USER_CREATION" and
        $create.metadata.product_event_type = "Add user." and
        $create.metadata.product_name = "Office 365" and
        $create.security_result.action = "ALLOW" and
        $create.target.user.userid = $userid
    )
    $create.metadata.event_timestamp.seconds < $role.metadata.event_timestamp.seconds
    (
        $role.metadata.event_type = "USER_UNCATEGORIZED" and
        $role.metadata.product_event_type = "Add member to role." and
        $role.metadata.product_name = "Office 365" and
        $role.security_result.action = "ALLOW" and
        //The reference list msgraph_watchlist_roles matches on the role name. List contents example row: Global Administrator //manage all aspects of Azure AD and Microsoft services that use Azure AD identities 62e90394-69f5-4237-9190-012177145e10
        //If you wanted to detect on specific roles, they could be added to a reference list and the following line uncommented
        //$role.target.resource.attribute.roles.name in %msgraph_watchlist_roles and
        $role.target.user.userid = $userid
    )

  match:
    $userid over 90m

  outcome:
    $risk_score = max(if($role.target.resource.attribute.roles.name = /Administrator/ nocase, 85, 35))
    $security_summary = array_distinct($role.security_result.summary)
    $user_agent = array_distinct($role.network.http.user_agent)
    $assigned_role = array_distinct($role.target.resource.attribute.roles.name)
    //added to populate alert graph with additional context
    $principal_user_userid = array_distinct($create.principal.user.userid)
    $target_user_userid = array_distinct($create.target.user.userid)

  condition:
    $create and $role
}