O365 Recently Created Entra ID User Assigned Roles

/*
 * Copyright 2023 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rule o365_recently_created_entra_id_user_assigned_roles {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a user is created in Entra ID and assigned roles within a defined time window."
    rule_id = "mr_c0406a96-4ed1-4dd2-9629-aa5a2c881222"
    rule_name = "O365 Recently Created Entra ID User Assigned Roles"
    tactic = "TA0003"
    technique = "T1098.003"
    assumption = "The list msgraph_watchlist_roles is populated with role names, ie Application Administrator"
    type = "alert"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    (
        $create.metadata.event_type = "USER_CREATION" and
        $create.metadata.product_event_type = "Add user." and
        $create.metadata.product_name = "Office 365" and
        $create.security_result.action = "ALLOW" and
        $create.target.user.userid = $userid
    )
    $create.metadata.event_timestamp.seconds < $role.metadata.event_timestamp.seconds
    (
        $role.metadata.event_type = "USER_UNCATEGORIZED" and
        $role.metadata.product_event_type = "Add member to role." and
        $role.metadata.product_name = "Office 365" and
        $role.security_result.action = "ALLOW" and
        //The reference list msgraph_watchlist_roles matches on the role name. List contents example row: Global Administrator //manage all aspects of Azure AD and Microsoft services that use Azure AD identities 62e90394-69f5-4237-9190-012177145e10
        //If you wanted to detect on specific roles, they could be added to a reference list and the following line uncommented
        //$role.target.resource.attribute.roles.name in %msgraph_watchlist_roles and
        $role.target.user.userid = $userid
    )

  match:
    $userid over 90m

  outcome:
    $risk_score = max(if($role.target.resource.attribute.roles.name = /Administrator/ nocase, 85, 35))
    $security_summary = array_distinct($role.security_result.summary)
    $user_agent = array_distinct($role.network.http.user_agent)
    $assigned_role = array_distinct($role.target.resource.attribute.roles.name)
    //added to populate alert graph with additional context
    $principal_user_userid = array_distinct($create.principal.user.userid)
    $target_user_userid = array_distinct($create.target.user.userid)

  condition:
    $create and $role
}