Privileged Account Permissions Changed

Severity: medium
Time window: 2d
Group by: AccountUPN
Source: github.com/Azure/Azure-Sentinel

Detects changes to permissions assigned to admin users. Threat actors may try and increase permission scope by adding additional roles to already privileged accounts. Review any modifications to ensure they were made legitimately. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts

Telemetry coverage

Provider	Record / event type
Microsoft Defender for Endpoint	`IdentityInfo` action `any`: Identity information
Entra-AuditLogs	any: Entra ID audit event (any operation)

Rules detecting the same action

These rules filter on the same operation.

Rule body

id: 0433c8a3-9aa6-4577-beef-2ea23be41137
name: Privileged Account Permissions Changed
description: |
  'Detects changes to permissions assigned to admin users. Threat actors may try and increase permission scope by adding additional roles to already privileged accounts.
  Review any modifications to ensure they were made legitimately.
  Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
  - connectorId: BehaviorAnalytics
    dataTypes:
      - IdentityInfo
queryFrequency: 1d
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques:
  - T1078.004
tags:
  - AADSecOpsGuide
query: |
  let admin_users = (IdentityInfo
    | where TimeGenerated > ago(2d)
    | summarize arg_max(TimeGenerated, *) by AccountUPN
    | where AssignedRoles contains "admin" or GroupMembership has "Admin"
    | summarize by tolower(AccountUPN));
    AuditLogs
    | where Category =~ "RoleManagement"
    | where OperationName has "Add eligible member"
    | extend TargetUserPrincipalName = tostring(TargetResources[0].userPrincipalName)
    | where tolower(TargetUserPrincipalName) in (admin_users)
    | extend TargetAadUserId = tostring(TargetResources[0].id)
    | extend Group = tostring(TargetResources[0].displayName)
    | extend RoleAddedTo = iif(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, Group)
    | extend mod_props = TargetResources[0].modifiedProperties
    | extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
    | extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
    | extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
    | extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
    | extend InitiatingIPAddress = tostring(InitiatedBy.user.ipAddress)
    | extend RoleAddedBy = iif(isnotempty(InitiatingAppName), InitiatingAppName, InitiatingUserPrincipalName)
    | mv-expand mod_props
    | where mod_props.displayName == "Role.DisplayName"
    | extend UserAgent = tostring(AdditionalDetails[0].value)
    | extend RoleAdded = tostring(parse_json(tostring(mod_props.newValue)))
    | extend TargetAccountName = tostring(split(TargetUserPrincipalName, "@")[0]), TargetAccountUPNSuffix = tostring(split(TargetUserPrincipalName, "@")[1])
    | extend InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, "@")[0]), InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, "@")[1])
    | project-reorder TimeGenerated, OperationName, TargetUserPrincipalName, RoleAddedTo, RoleAdded, RoleAddedBy, InitiatingUserPrincipalName, InitiatingAppName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: TargetUserPrincipalName
      - identifier: Name
        columnName: TargetAccountName
      - identifier: UPNSuffix
        columnName: TargetAccountUPNSuffix
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: TargetAadUserId
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: InitiatingUserPrincipalName
      - identifier: Name
        columnName: InitiatingAccountName
      - identifier: UPNSuffix
        columnName: InitiatingAccountUPNSuffix
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: InitiatingAadUserId
version: 1.0.7
kind: Scheduled

Stages and Predicates

Let binding: `admin_users` used in Stages 1, 6

let admin_users = (IdentityInfo
  | where TimeGenerated > ago(2d)
  | summarize arg_max(TimeGenerated, *) by AccountUPN
  | where AssignedRoles contains "admin" or GroupMembership has "Admin"
  | summarize by tolower(AccountUPN));

Stage 1: `source`

let admin_users

Stage 2: `source`

AuditLogs

Stage 3: `where`

where Category =~ "RoleManagement"

Stage 4: `where`

where OperationName contains "Add eligible member"

Stage 5: `extend`

extend TargetUserPrincipalName

Stage 6: `where`

where TargetUserPrincipalName =~ "admin_users"

Stage 7: `extend` (10 consecutive steps)

extend Group, InitiatingAadUserId, InitiatingAppName, InitiatingAppServicePrincipalId, InitiatingIPAddress, InitiatingUserPrincipalName, RoleAddedBy, RoleAddedTo, TargetAadUserId, mod_props

Stage 8: `mv-expand`

mv-expand mod_props

Stage 9: `where`

where displayName =~ "Role.DisplayName"

Stage 10: `extend` (4 consecutive steps)

extend InitiatingAccountName, InitiatingAccountUPNSuffix, RoleAdded, TargetAccountName, TargetAccountUPNSuffix, UserAgent

Stage 11: `project-reorder`

project-reorder

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Category`	eq	`RoleManagement`	`field:"Category" kind:eq value:"RoleManagement"`
`OperationName`	match	`Add eligible member` transforms: `term`	`field:"OperationName" kind:match value:"Add eligible member"`
`TargetUserPrincipalName`	in	`admin_users` transforms: `tolower`	`field:"azure_ad::target_user_upn" kind:in value:"admin_users"`
`displayName`	eq	`Role.DisplayName`	`field:"displayName" kind:eq value:"Role.DisplayName"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`TargetUserPrincipalName`	`extend`
`TargetAadUserId`	`extend`
`Group`	`extend`
`RoleAddedTo`	`extend`
`mod_props`	`extend`
`InitiatingAppName`	`extend`
`InitiatingAppServicePrincipalId`	`extend`
`InitiatingUserPrincipalName`	`extend`
`InitiatingAadUserId`	`extend`
`InitiatingIPAddress`	`extend`
`RoleAddedBy`	`extend`
`UserAgent`	`extend`
`RoleAdded`	`extend`
`TargetAccountName`	`extend`
`TargetAccountUPNSuffix`	`extend`
`InitiatingAccountName`	`extend`
`InitiatingAccountUPNSuffix`	`extend`

Privileged Account Permissions Changed

MITRE ATT&CK coverage

Telemetry coverage

Rules detecting the same action

Rule body

Stages and Predicates

Let binding: admin_users used in Stages 1, 6

Stage 1: source

Stage 2: source

Stage 3: where

Stage 4: where

Stage 5: extend

Stage 6: where

Stage 7: extend (10 consecutive steps)

Stage 8: mv-expand

Stage 9: where

Stage 10: extend (4 consecutive steps)

Stage 11: project-reorder