Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

AWS role with shadow admin privileges

Back
Id2526079b-3355-4756-a2d1-21e9cd957261
RulenameAWS role with shadow admin privileges
DescriptionThe policy detect the creation of new AWS roles with shadow admin privileges. The policy configuration allows limiting the policy to specific accounts.
SeverityHigh
TacticsInitialAccess
TechniquesT1078
Required data connectorsAuthomize
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/AWS_role_with_shadow_admin_privileges.yaml
Version1.0.2
Arm template2526079b-3355-4756-a2d1-21e9cd957261.json
Deploy To Azure
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s 
| where Policy has "AWS role with shadow admin privileges"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/AWS_role_with_shadow_admin_privileges.yaml
triggerThreshold: 0
severity: High
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    matchingMethod: AnyAlert
    reopenClosedIncident: false
    groupByEntities: []
    lookbackDuration: 5h
    groupByCustomDetails: []
    groupByAlertDetails: []
entityMappings:
- fieldMappings:
  - columnName: URL
    identifier: Url
  entityType: URL
status: Available
suppressionEnabled: false
customDetails:
  EventDescription: Description
  ReferencedURL: URL
  EventName: Policy
  AuthomizeEventID: EventID
  EventRecommendation: Recommendation
relevantTechniques:
- T1078
triggerOperator: gt
version: 1.0.2
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 2526079b-3355-4756-a2d1-21e9cd957261
queryFrequency: 30m
alertDetailsOverride:
  alertnameFormat: Alert from Authomize - AWS role with shadow admin privileges
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: URL
  alertTactics: Tactics
  alertDescriptionFormat: |
        IaaS shadow admin detected. The policy detect the creation of new AWS roles with shadow admin privileges. The policy configuration allows limiting the policy to specific accounts.
  alertSeverity: Severity
name: AWS role with shadow admin privileges
suppressionDuration: 5h
requiredDataConnectors:
- connectorId: Authomize
  dataTypes:
  - Authomize_v2_CL
description: The policy detect the creation of new AWS roles with shadow admin privileges. The policy configuration allows limiting the policy to specific accounts.
query: |-
  Authomize_v2_CL
  | where ingestion_time() >= ago(30m)
  | extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s 
  | where Policy has "AWS role with shadow admin privileges"
  | project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics  
tactics:
- InitialAccess
queryPeriod: 30m
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2526079b-3355-4756-a2d1-21e9cd957261')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2526079b-3355-4756-a2d1-21e9cd957261')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "IaaS shadow admin detected. The policy detect the creation of new AWS roles with shadow admin privileges. The policy configuration allows limiting the policy to specific accounts.\n",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "URL"
            }
          ],
          "alertnameFormat": "Alert from Authomize - AWS role with shadow admin privileges",
          "alertSeverity": "Severity",
          "alertTactics": "Tactics"
        },
        "alertRuleTemplateName": "2526079b-3355-4756-a2d1-21e9cd957261",
        "customDetails": {
          "AuthomizeEventID": "EventID",
          "EventDescription": "Description",
          "EventName": "Policy",
          "EventRecommendation": "Recommendation",
          "ReferencedURL": "URL"
        },
        "description": "The policy detect the creation of new AWS roles with shadow admin privileges. The policy configuration allows limiting the policy to specific accounts.",
        "displayName": "AWS role with shadow admin privileges",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/AWS_role_with_shadow_admin_privileges.yaml",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s \n| where Policy has \"AWS role with shadow admin privileges\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}