Azure secure score role overlap

Status: available
Severity: medium
Time window: 6h
Source: github.com/Azure/Azure-Sentinel

'This query searches for accounts that have been assigned Global Administrator do not need other roles assigned. Global Administrators have access to all aspects of Azure'

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1529` System Shutdown/Reboot

Rule body

id: 8E6D9A66-F1B0-463D-BA90-11A5AEC0E15A
name: Azure secure score role overlap
description: |
  'This query searches for accounts that have been assigned Global Administrator do not need other roles assigned. 
    Global Administrators have access to all aspects of Azure'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SenservaPro
    dataTypes:
      - SenservaPro_CL
queryFrequency: 6h
queryPeriod: 6h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1529
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreRoleOverlap'
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: ControlName_s
      - identifier: AadTenantId
        columnName: TenantId
      - identifier: DisplayName
        columnName: TenantDisplayName_s 
  - entityType: SecurityGroup
    fieldMappings:
      - identifier: DistinguishedName
        columnName: Group_s
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: SourceSystem 
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SenservaPro_CL

Stage 2: `where`

| where ControlName_s == 'AzureSecureScoreRoleOverlap'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ControlName_s`	eq	`AzureSecureScoreRoleOverlap`	`field:"ControlName_s" kind:eq value:"AzureSecureScoreRoleOverlap"`