Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

IaaS shadow admin detected

Back
Id31f43e9d-1839-4baf-a668-54c28b98af3e
RulenameIaaS shadow admin detected
DescriptionThe policy detects shadow admin users in AWS or Azure.
SeverityHigh
TacticsInitialAccess
TechniquesT1078
Required data connectorsAuthomize
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/IaaS_shadow_admin_detected.yaml
Version1.0.2
Arm template31f43e9d-1839-4baf-a668-54c28b98af3e.json
Deploy To Azure
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "IaaS shadow admin detected"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/IaaS_shadow_admin_detected.yaml
query: |-
  Authomize_v2_CL
  | where ingestion_time() >= ago(30m)
  | extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
  | where Policy has "IaaS shadow admin detected"
  | project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics  
description: The policy detects shadow admin users in AWS or Azure.
severity: High
requiredDataConnectors:
- dataTypes:
  - Authomize_v2_CL
  connectorId: Authomize
incidentConfiguration:
  groupingConfiguration:
    groupByAlertDetails: []
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
    groupByEntities: []
    matchingMethod: AnyAlert
    groupByCustomDetails: []
  createIncident: true
eventGroupingSettings:
  aggregationKind: SingleAlert
name: IaaS shadow admin detected
triggerThreshold: 0
version: 1.0.2
customDetails:
  AuthomizeEventID: EventID
  ReferencedURL: URL
  EventDescription: Description
  EventRecommendation: Recommendation
  EventName: Policy
entityMappings:
- entityType: URL
  fieldMappings:
  - columnName: URL
    identifier: Url
tactics:
- InitialAccess
alertDetailsOverride:
  alertDescriptionFormat: |
        IaaS shadow admin detected. The policy detects shadow admin users in AWS or Azure.
  alertDynamicProperties:
  - value: URL
    alertProperty: AlertLink
  alertSeverity: Severity
  alertnameFormat: Alert from Authomize - IaaS shadow admin detected
  alertTactics: Tactics
relevantTechniques:
- T1078
triggerOperator: gt
kind: Scheduled
id: 31f43e9d-1839-4baf-a668-54c28b98af3e
status: Available
suppressionEnabled: false
queryFrequency: 30m
queryPeriod: 30m
suppressionDuration: 5h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/31f43e9d-1839-4baf-a668-54c28b98af3e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/31f43e9d-1839-4baf-a668-54c28b98af3e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "IaaS shadow admin detected. The policy detects shadow admin users in AWS or Azure.\n",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "URL"
            }
          ],
          "alertnameFormat": "Alert from Authomize - IaaS shadow admin detected",
          "alertSeverity": "Severity",
          "alertTactics": "Tactics"
        },
        "alertRuleTemplateName": "31f43e9d-1839-4baf-a668-54c28b98af3e",
        "customDetails": {
          "AuthomizeEventID": "EventID",
          "EventDescription": "Description",
          "EventName": "Policy",
          "EventRecommendation": "Recommendation",
          "ReferencedURL": "URL"
        },
        "description": "The policy detects shadow admin users in AWS or Azure.",
        "displayName": "IaaS shadow admin detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/IaaS_shadow_admin_detected.yaml",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s\n| where Policy has \"IaaS shadow admin detected\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}