Elevation of Privilege attempt detected

Back


Id	7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a
Rulename	Elevation of Privilege attempt detected
Description	Identifies Elevation of Privilege attempt Azure Firewall IDPS logs.
Severity	High
Tactics	InitialAccess CredentialAccess
Techniques	T1078 T1110
Required data connectors	AzureFirewall
Kind	Scheduled
Query frequency	1h
Query period	24h
Trigger threshold	1
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Elevation of Privilege attempt detected.yaml
Version	1.0.0
Arm template	7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a.json

KQL

let TimeWindow   = 90d;    // How far back to look 
let HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category
let MinSeverity  = 1;      // Set Minimum Severity
// Feature flags for optional filters
let EnableCategoryFilter    = true;   // Filter 1
let EnableDescriptionFilter = false;  // Filter 2
let EnableActionFilter      = false;  // Filter 3
// Filter 1: Categories of interest
let CategoriesOfInterest = dynamic([
    "Attempted User Privilege Gain",
    "Unsuccessful User Privilege Gain",
    "Successful User Privilege Gain",
    "Attempted Administrator Privilege Gain",
    "Successful Administrator Privilege Gain"
]);
// Filter 2: Descriptions of interest
let DescriptionsOfInterest = dynamic([
    "attempted-user",
    "unsuccessful-user",
    "successful-user",
    "attempted-admin",
    "successful-admin"
]);
// Filter 3: Action match
let MatchActions = dynamic(["Deny", "alert"]);
AZFWIdpsSignature
| where TimeGenerated >= ago(TimeWindow)
| where Severity >= MinSeverity
// Filter 1: Category filter (optional)
| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
// Filter 2: Description filter (optional)
| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
// Filter 3: Action filter (optional)
| where (EnableActionFilter == false) or (Action in~ (MatchActions))
| summarize
    StartTime   = min(TimeGenerated),
    EndTime     = max(TimeGenerated),
    TotalHits   = count(),
    MaxSeverity = max(Severity),
    Actions     = make_set(Action, 5),
    Signatures  = make_set(SignatureId, 20),
    Description = make_set(substring(tostring(Description), 0, 120), 3)
    by SourceIp, ThreatCategory = Category
| where TotalHits >= HitThreshold
| project
    StartTime,
    EndTime,
    SourceIp,
    ThreatCategory,
    TotalHits,
    MaxSeverity,
    Actions,
    Signatures,
    Description
| order by MaxSeverity desc, TotalHits desc

YAML

relevantTechniques:
- T1078
- T1110
name: Elevation of Privilege attempt detected
queryFrequency: 1h
version: 1.0.0
triggerThreshold: 1
severity: High
requiredDataConnectors:
- connectorId: AzureFirewall
  dataTypes:
  - AZFWIdpsSignature
tactics:
- InitialAccess
- CredentialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Elevation of Privilege attempt detected.yaml
query: |
  let TimeWindow   = 90d;    // How far back to look 
  let HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category
  let MinSeverity  = 1;      // Set Minimum Severity
  // Feature flags for optional filters
  let EnableCategoryFilter    = true;   // Filter 1
  let EnableDescriptionFilter = false;  // Filter 2
  let EnableActionFilter      = false;  // Filter 3
  // Filter 1: Categories of interest
  let CategoriesOfInterest = dynamic([
      "Attempted User Privilege Gain",
      "Unsuccessful User Privilege Gain",
      "Successful User Privilege Gain",
      "Attempted Administrator Privilege Gain",
      "Successful Administrator Privilege Gain"
  ]);
  // Filter 2: Descriptions of interest
  let DescriptionsOfInterest = dynamic([
      "attempted-user",
      "unsuccessful-user",
      "successful-user",
      "attempted-admin",
      "successful-admin"
  ]);
  // Filter 3: Action match
  let MatchActions = dynamic(["Deny", "alert"]);
  AZFWIdpsSignature
  | where TimeGenerated >= ago(TimeWindow)
  | where Severity >= MinSeverity
  // Filter 1: Category filter (optional)
  | where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
  // Filter 2: Description filter (optional)
  | where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
  // Filter 3: Action filter (optional)
  | where (EnableActionFilter == false) or (Action in~ (MatchActions))
  | summarize
      StartTime   = min(TimeGenerated),
      EndTime     = max(TimeGenerated),
      TotalHits   = count(),
      MaxSeverity = max(Severity),
      Actions     = make_set(Action, 5),
      Signatures  = make_set(SignatureId, 20),
      Description = make_set(substring(tostring(Description), 0, 120), 3)
      by SourceIp, ThreatCategory = Category
  | where TotalHits >= HitThreshold
  | project
      StartTime,
      EndTime,
      SourceIp,
      ThreatCategory,
      TotalHits,
      MaxSeverity,
      Actions,
      Signatures,
      Description
  | order by MaxSeverity desc, TotalHits desc  
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: SourceIp
    identifier: Address
  entityType: IP
queryPeriod: 24h
triggerOperator: GreaterThan
id: 7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a
status: Available
description: |
    Identifies Elevation of Privilege attempt Azure Firewall IDPS logs.

ARM