User Added to Admin Role

AuditLogs
  | where OperationName in ("Add eligible member (permanent)", "Add eligible member (eligible)", "Add member to role")
  | mv-apply TargetResource = TargetResources on 
  (
      where TargetResource.type =~ "User"
      | extend Target = tostring(TargetResource.userPrincipalName),
               props = TargetResource.modifiedProperties
  )
  | mv-apply Property = props on 
  (
      where Property.displayName =~ "Role.DisplayName"
      | extend RoleName = trim('"',tostring(Property.newValue))
  )
  | where RoleName contains "admin"
  | extend InitiatingApp = tostring(InitiatedBy.app.displayName)
  | extend Initiator = iif(isnotempty(InitiatingApp), InitiatingApp, tostring(InitiatedBy.user.userPrincipalName))
  | extend AddedUser = iff(OperationName=="Add member to role",tostring(TargetResources[0].userPrincipalName),tostring(TargetResources[2].userPrincipalName))
  | project-reorder TimeGenerated, AddedUser, RoleName, Initiator

tags:
- AADSecOpsGuide
version: 1.0.2
name: User Added to Admin Role
severity: Low
queryFrequency: 1d
kind: Scheduled
queryPeriod: 1d
description: |
  'Detects a user being added to a new privileged role. Monitor these additions to ensure the users are made eligible for these roles are intended to have these levels of access.
    Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts'  
query: |
  AuditLogs
    | where OperationName in ("Add eligible member (permanent)", "Add eligible member (eligible)", "Add member to role")
    | mv-apply TargetResource = TargetResources on 
    (
        where TargetResource.type =~ "User"
        | extend Target = tostring(TargetResource.userPrincipalName),
                 props = TargetResource.modifiedProperties
    )
    | mv-apply Property = props on 
    (
        where Property.displayName =~ "Role.DisplayName"
        | extend RoleName = trim('"',tostring(Property.newValue))
    )
    | where RoleName contains "admin"
    | extend InitiatingApp = tostring(InitiatedBy.app.displayName)
    | extend Initiator = iif(isnotempty(InitiatingApp), InitiatingApp, tostring(InitiatedBy.user.userPrincipalName))
    | extend AddedUser = iff(OperationName=="Add member to role",tostring(TargetResources[0].userPrincipalName),tostring(TargetResources[2].userPrincipalName))
    | project-reorder TimeGenerated, AddedUser, RoleName, Initiator  
tactics:
- PrivilegeEscalation
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Initiator
    identifier: FullName
- entityType: Account
  fieldMappings:
  - columnName: AddedUser
    identifier: FullName
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Business Email Compromise - Financial Fraud/Analytic Rules/UserAddedtoAdminRole.yaml
requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - AuditLogs
relevantTechniques:
- T1078.004
id: 2a09f8cb-deb7-4c40-b08b-9137667f1c0b

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/2a09f8cb-deb7-4c40-b08b-9137667f1c0b')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "User Added to Admin Role",
        "description": "'Detects a user being added to a new privileged role. Monitor these additions to ensure the users are made eligible for these roles are intended to have these levels of access.\n  Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts'\n",
        "severity": "Low",
        "enabled": true,
        "query": "AuditLogs\n  | where OperationName in (\"Add eligible member (permanent)\", \"Add eligible member (eligible)\", \"Add member to role\")\n  | mv-apply TargetResource = TargetResources on \n  (\n      where TargetResource.type =~ \"User\"\n      | extend Target = tostring(TargetResource.userPrincipalName),\n               props = TargetResource.modifiedProperties\n  )\n  | mv-apply Property = props on \n  (\n      where Property.displayName =~ \"Role.DisplayName\"\n      | extend RoleName = trim('\"',tostring(Property.newValue))\n  )\n  | where RoleName contains \"admin\"\n  | extend InitiatingApp = tostring(InitiatedBy.app.displayName)\n  | extend Initiator = iif(isnotempty(InitiatingApp), InitiatingApp, tostring(InitiatedBy.user.userPrincipalName))\n  | extend AddedUser = iff(OperationName==\"Add member to role\",tostring(TargetResources[0].userPrincipalName),tostring(TargetResources[2].userPrincipalName))\n  | project-reorder TimeGenerated, AddedUser, RoleName, Initiator\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078.004"
        ],
        "alertRuleTemplateName": "2a09f8cb-deb7-4c40-b08b-9137667f1c0b",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "Initiator",
                "identifier": "FullName"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "columnName": "AddedUser",
                "identifier": "FullName"
              }
            ],
            "entityType": "Account"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Business Email Compromise - Financial Fraud/Analytic Rules/UserAddedtoAdminRole.yaml",
        "templateVersion": "1.0.2",
        "tags": [
          "AADSecOpsGuide"
        ]
      }
    }
  ]
}