detection.wiki

Detection rules › Kusto

SlackAudit - User role changed to admin or owner

Status
available
Severity
low
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege escalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the primary account entity for investigation.'

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1078 Valid Accounts, T1098 Account Manipulation
Privilege EscalationT1078 Valid Accounts, T1098 Account Manipulation

Rule body kusto

id: be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e
name: SlackAudit - User role changed to admin or owner
description: |
  'This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege
  escalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the
  primary account entity for investigation.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: SlackAuditAPI
    dataTypes:
      - SlackAudit_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - PrivilegeEscalation
relevantTechniques:
  - T1098
  - T1078
query: |
  SlackAudit
  | where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')
  | extend AccountCustomEntity = SrcUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
alertDetailsOverride:
  alertDisplayNameFormat: Slack user role changed to {{AccountCustomEntity}}
  alertDescriptionFormat: Slack role change action {{DvcAction}} affected user {{AccountCustomEntity}}
customDetails:
  AffectedUser: AccountCustomEntity
  Action: DvcAction
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: source

SlackAudit

Stage 2: where

| where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')

Stage 3: extend

| extend AccountCustomEntity = SrcUserName

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DvcActionin
  • role_change_to_admin
  • role_change_to_owner

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
AccountCustomEntityextend