Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

AWS role with admin privileges

Back
Id734c00a0-a95b-44dd-9b69-d926ed44256d
RulenameAWS role with admin privileges
DescriptionThe policy detects the creation of new AWS roles with administrative privileges. The policy configuration allows limiting the policy to specific accounts.
SeverityHigh
TacticsInitialAccess
TechniquesT1078
Required data connectorsAuthomize
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/AWS_role_with_admin_privileges.yaml
Version1.0.2
Arm template734c00a0-a95b-44dd-9b69-d926ed44256d.json
Deploy To Azure
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s  
| where Policy has "AWS role with admin privileges"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
kind: Scheduled
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDynamicProperties:
  - value: URL
    alertProperty: AlertLink
  alertSeverity: Severity
  alertTactics: Tactics
  alertDescriptionFormat: AWS role with admin privileges. The policy detects the creation of new AWS roles with administrative privileges. The policy configuration allows limiting the policy to specific accounts.
  alertnameFormat: Alert from Authomize - AWS role with admin privileges
entityMappings:
- entityType: URL
  fieldMappings:
  - columnName: URL
    identifier: Url
suppressionDuration: 5h
description: The policy detects the creation of new AWS roles with administrative privileges. The policy configuration allows limiting the policy to specific accounts.
severity: High
queryFrequency: 30m
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AnyAlert
    enabled: true
    groupByCustomDetails: []
    groupByEntities: []
    groupByAlertDetails: []
  createIncident: true
triggerThreshold: 0
relevantTechniques:
- T1078
suppressionEnabled: false
status: Available
customDetails:
  EventRecommendation: Recommendation
  ReferencedURL: URL
  AuthomizeEventID: EventID
  EventName: Policy
  EventDescription: Description
tactics:
- InitialAccess
name: AWS role with admin privileges
id: 734c00a0-a95b-44dd-9b69-d926ed44256d
query: |-
  Authomize_v2_CL
  | where ingestion_time() >= ago(30m)
  | extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s  
  | where Policy has "AWS role with admin privileges"
  | project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics  
requiredDataConnectors:
- dataTypes:
  - Authomize_v2_CL
  connectorId: Authomize
version: 1.0.2
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/AWS_role_with_admin_privileges.yaml
queryPeriod: 30m
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/734c00a0-a95b-44dd-9b69-d926ed44256d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/734c00a0-a95b-44dd-9b69-d926ed44256d')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "AWS role with admin privileges. The policy detects the creation of new AWS roles with administrative privileges. The policy configuration allows limiting the policy to specific accounts.",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "URL"
            }
          ],
          "alertnameFormat": "Alert from Authomize - AWS role with admin privileges",
          "alertSeverity": "Severity",
          "alertTactics": "Tactics"
        },
        "alertRuleTemplateName": "734c00a0-a95b-44dd-9b69-d926ed44256d",
        "customDetails": {
          "AuthomizeEventID": "EventID",
          "EventDescription": "Description",
          "EventName": "Policy",
          "EventRecommendation": "Recommendation",
          "ReferencedURL": "URL"
        },
        "description": "The policy detects the creation of new AWS roles with administrative privileges. The policy configuration allows limiting the policy to specific accounts.",
        "displayName": "AWS role with admin privileges",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/AWS_role_with_admin_privileges.yaml",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s  \n| where Policy has \"AWS role with admin privileges\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}