App Granted Microsoft Permissions

Status: test
Severity: high
Log source: product azure, service auditlogs
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
Source: github.com/SigmaHQ/sigma

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Known false positives

When the permission is legitimately needed for the app

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1528` Steal Application Access Token

Telemetry coverage

Platform	Record / event type
Azure	Add app role assignment to service principal
Azure	Add delegated permission grant

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: App Granted Microsoft Permissions
id: c1d147ae-a951-48e5-8b41-dcd0170c7213
status: test
description: Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
date: 2022-07-10
tags:
    - attack.credential-access
    - attack.t1528
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message:
            - Add delegated permission grant
            - Add app role assignment to service principal
    condition: selection
falsepositives:
    - When the permission is legitimately needed for the app
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    properties.message:
        - Add delegated permission grant
        - Add app role assignment to service principal

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`properties.message`	eq	`Add app role assignment to service principal` `Add delegated permission grant`	`field:"properties.message" kind:eq`