ContraForce - Privileged access change | Microsoft Sentinel Analytic Rules

Back


Id	3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31
Rulename	ContraForce - Privileged access change
Description	Identifies administrative access changes made in the ContraForce workspace: workspace role assignments, changes and removals, organization role changes, member additions and removals, and service provider (MSP) access grants or revocations. Review each change to confirm it was expected and authorized. The affected member and the old and new roles are carried in the event metadata.
Severity	Medium
Tactics	PrivilegeEscalation Persistence
Techniques	T1078 T1098
Required data connectors	ContraForceEvents
Kind	Scheduled
Query frequency	5m
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContraForce/Analytic%20Rules/ContraForcePrivilegedAccessChange.yaml
Version	1.0.0
Arm template	3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31.json

KQL

ContraForceEvents_CL
| where ingestion_time() > ago(5m)
| where ActivityType in ("WorkspaceRoleAssigned", "WorkspaceRoleChanged", "WorkspaceRoleRemoved", "OrganizationalRoleChanged", "MemberAdded", "MemberRemoved", "ServiceProviderAdded", "ServiceProviderRemoved")
| extend Meta = parse_json(Metadata)
| extend MemberEmail = tostring(Meta.MemberEmail),
         MemberType = tostring(Meta.MemberType),
         FromRole = tostring(Meta.FromRole),
         ToRole = tostring(Meta.ToRole),
         Members = tostring(Meta.Members)
| project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,
          ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName,
          MemberEmail, MemberType, FromRole, ToRole, Members

YAML

relevantTechniques:
- T1078
- T1098
triggerThreshold: 0
id: 3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryPeriod: 1d
triggerOperator: gt
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    matchingMethod: Selected
    groupByCustomDetails:
    - EventId
    lookbackDuration: PT2H
alertDetailsOverride:
  alertDisplayNameFormat: 'ContraForce access change: {{ActivityType}} on {{TargetResourceName}}'
  alertDescriptionFormat: '{{ActorName}} performed {{ActivityType}} on {{TargetResourceName}}. Member email, old and new roles are in the alert custom details.'
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContraForce/Analytic%20Rules/ContraForcePrivilegedAccessChange.yaml
queryFrequency: 5m
requiredDataConnectors:
- dataTypes:
  - ContraForceEvents_CL
  connectorId: ContraForceEvents
tactics:
- PrivilegeEscalation
- Persistence
query: |
  ContraForceEvents_CL
  | where ingestion_time() > ago(5m)
  | where ActivityType in ("WorkspaceRoleAssigned", "WorkspaceRoleChanged", "WorkspaceRoleRemoved", "OrganizationalRoleChanged", "MemberAdded", "MemberRemoved", "ServiceProviderAdded", "ServiceProviderRemoved")
  | extend Meta = parse_json(Metadata)
  | extend MemberEmail = tostring(Meta.MemberEmail),
           MemberType = tostring(Meta.MemberType),
           FromRole = tostring(Meta.FromRole),
           ToRole = tostring(Meta.ToRole),
           Members = tostring(Meta.Members)
  | project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,
            ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName,
            MemberEmail, MemberType, FromRole, ToRole, Members
name: ContraForce - Privileged access change
severity: Medium
version: 1.0.0
customDetails:
  ToRole: ToRole
  EventId: EventId
  ActorEmail: ActorEmail
  CfWorkspaceId: CfWorkspaceId
  FromRole: FromRole
  MemberEmail: MemberEmail
description: |
  'Identifies administrative access changes made in the ContraForce workspace: workspace role
  assignments, changes and removals, organization role changes, member additions and removals,
  and service provider (MSP) access grants or revocations. Review each change to confirm it was
  expected and authorized. The affected member and the old and new roles are carried in the
  event metadata.'
kind: Scheduled

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{ActorName}} performed {{ActivityType}} on {{TargetResourceName}}. Member email, old and new roles are in the alert custom details.",
          "alertDisplayNameFormat": "ContraForce access change: {{ActivityType}} on {{TargetResourceName}}"
        },
        "alertRuleTemplateName": "3f4bd2a1-7c58-4a83-9c2e-6d1f0a8b5c31",
        "customDetails": {
          "ActorEmail": "ActorEmail",
          "CfWorkspaceId": "CfWorkspaceId",
          "EventId": "EventId",
          "FromRole": "FromRole",
          "MemberEmail": "MemberEmail",
          "ToRole": "ToRole"
        },
        "description": "'Identifies administrative access changes made in the ContraForce workspace: workspace role\nassignments, changes and removals, organization role changes, member additions and removals,\nand service provider (MSP) access grants or revocations. Review each change to confirm it was\nexpected and authorized. The affected member and the old and new roles are carried in the\nevent metadata.'\n",
        "displayName": "ContraForce - Privileged access change",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "EventId"
            ],
            "lookbackDuration": "PT2H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContraForce/Analytic%20Rules/ContraForcePrivilegedAccessChange.yaml",
        "query": "ContraForceEvents_CL\n| where ingestion_time() > ago(5m)\n| where ActivityType in (\"WorkspaceRoleAssigned\", \"WorkspaceRoleChanged\", \"WorkspaceRoleRemoved\", \"OrganizationalRoleChanged\", \"MemberAdded\", \"MemberRemoved\", \"ServiceProviderAdded\", \"ServiceProviderRemoved\")\n| extend Meta = parse_json(Metadata)\n| extend MemberEmail = tostring(Meta.MemberEmail),\n         MemberType = tostring(Meta.MemberType),\n         FromRole = tostring(Meta.FromRole),\n         ToRole = tostring(Meta.ToRole),\n         Members = tostring(Meta.Members)\n| project TimeGenerated, EventId, CfWorkspaceId, ActivityType, ActivityAction,\n          ActorName, ActorEmail, TargetResourceType, TargetResourceId, TargetResourceName,\n          MemberEmail, MemberType, FromRole, ToRole, Members\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078",
          "T1098"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}