SlackAudit - User role changed to admin or owner

Status: available
Severity: low
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege escalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the primary account entity for investigation.'

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1078` Valid Accounts `T1098` Account Manipulation
Privilege Escalation	`T1078` Valid Accounts `T1098` Account Manipulation

Rule body

id: be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e
name: SlackAudit - User role changed to admin or owner
description: |
  'This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege
  escalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the
  primary account entity for investigation.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: SlackAuditAPI
    dataTypes:
      - SlackAudit_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - PrivilegeEscalation
relevantTechniques:
  - T1098
  - T1078
query: |
  SlackAudit
  | where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')
  | extend AccountCustomEntity = SrcUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
alertDetailsOverride:
  alertDisplayNameFormat: Slack user role changed to {{AccountCustomEntity}}
  alertDescriptionFormat: Slack role change action {{DvcAction}} affected user {{AccountCustomEntity}}
customDetails:
  AffectedUser: AccountCustomEntity
  Action: DvcAction
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SlackAudit

Stage 2: `where`

| where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')

Stage 3: `extend`

| extend AccountCustomEntity = SrcUserName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DvcAction`	in	`role_change_to_admin` `role_change_to_owner`	`field:"DvcAction" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`extend`