Detection rules › Panther

Panther rules: admin

Rule	Severity
Admin Role Assigned	`medium`

Admin Role Assigned

Severity: medium
Log types: Asana.Audit, Atlassian.Audit, GCP.AuditLog, GitHub.Audit, GSuite.ActivityEvent, OneLogin.Events, Zendesk.Audit
Tags: DataModel, Privilege Escalation:Valid Accounts
Reference: medium.com
Source: github.com/panther-labs/panther-analysis

Assigning an admin role manually could be a sign of privilege escalation

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1078` Valid Accounts

Detection logic

import panther_event_type_helpers as event_type


def rule(event):
    # filter events on unified data model field
    return event.udm("event_type") == event_type.ADMIN_ROLE_ASSIGNED


def title(event):
    # use unified data model field in title
    recipient = event.udm("user") or event.get("team") or "USER_OR_TEAM_NOT_FOUND"
    return (
        f"{event.get('p_log_type')}: [{event.udm('actor_user')}] assigned admin privileges "
        f"[{event.udm('assigned_admin_role')}] to [{recipient}]"
    )


def alert_context(event):
    return {
        "ips": event.get("p_any_ip_addresses", []),
        "actor": event.udm("actor_user"),
        "user": event.udm("user"),
    }

Rule specification

AnalysisType: rule
Filename: admin_assigned.py
RuleID: "Standard.AdminRoleAssigned"
DisplayName: "Admin Role Assigned"
Enabled: true
LogTypes:
  - Asana.Audit
  - Atlassian.Audit
  - GCP.AuditLog
  - GitHub.Audit
  - GSuite.ActivityEvent
  - OneLogin.Events
  - Zendesk.Audit
Tags:
  - DataModel
  - Privilege Escalation:Valid Accounts
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0004:T1078
Description: Assigning an admin role manually could be a sign of privilege escalation
Runbook: Verify with the user who attached the role or add to a allowlist
Reference: https://medium.com/@gokulelango1040/privilege-escalation-attacks-28a9ef226abb
SummaryAttributes:
  - p_any_ip_addresses

Stages and Predicates

Fires on Asana.Audit, Atlassian.Audit, GCP.AuditLog (and 4 more) events when the condition below holds.

Condition

event_type is admin_role_assigned

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event_type`	eq	`admin_role_assigned`	`field:"event_type" kind:eq value:"admin_role_assigned"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field	Source
`ips`	`p_any_ip_addresses`
`actor`	`actor_user`
`user`
`p_log_type`
`assigned_admin_role`

Response runbook

Verify with the user who attached the role or add to a allowlist

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "p_log_type": "GCP.AuditLog",
  "protoPayload": {
    "at_sign_type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "bob@example.com"
    },
    "methodName": "SetIamPolicy",
    "requestMetadata": {
      "callerIP": "4.4.4.4"
    },
    "serviceData": {
      "@type": "type.googleapis.com/google.iam.v1.logging.AuditData",
      "policyDelta": {
        "bindingDeltas": [
          {
            "action": "ADD",
            "member": "cat@example.com",
            "role": "roles/resourcemanager.organizationAdmin"
          }
        ]
      }
    },
    "serviceName": "cloudresourcemanager.googleapis.com"
  }
}