Elevation of Privilege attempt detected | Microsoft Sentinel Analytic Rules

Back


Id	7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a
Rulename	Elevation of Privilege attempt detected
Description	Identifies Elevation of Privilege attempt Azure Firewall IDPS logs.
Severity	High
Tactics	InitialAccess CredentialAccess
Techniques	T1078 T1110
Required data connectors	AzureFirewall
Kind	Scheduled
Query frequency	1h
Query period	24h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Firewall/Analytic%20Rules/Azure%20Firewall%20-%20Elevation%20of%20Privilege%20attempt%20detected.yaml
Version	1.0.1
Arm template	7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a.json

KQL

let TimeWindow   = 90d;    // How far back to look 
let HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category
let MinSeverity  = 1;      // Set Minimum Severity
// Feature flags for optional filters
let EnableCategoryFilter    = true;   // Filter 1
let EnableDescriptionFilter = false;  // Filter 2
let EnableActionFilter      = false;  // Filter 3
// Filter 1: Categories of interest
let CategoriesOfInterest = dynamic([
    "Attempted User Privilege Gain",
    "Unsuccessful User Privilege Gain",
    "Successful User Privilege Gain",
    "Attempted Administrator Privilege Gain",
    "Successful Administrator Privilege Gain"
]);
// Filter 2: Descriptions of interest
let DescriptionsOfInterest = dynamic([
    "attempted-user",
    "unsuccessful-user",
    "successful-user",
    "attempted-admin",
    "successful-admin"
]);
// Filter 3: Action match
let MatchActions = dynamic(["Deny", "alert"]);
AZFWIdpsSignature
| where TimeGenerated >= ago(TimeWindow)
| where Severity >= MinSeverity
// Filter 1: Category filter (optional)
| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
// Filter 2: Description filter (optional)
| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
// Filter 3: Action filter (optional)
| where (EnableActionFilter == false) or (Action in~ (MatchActions))
| summarize
    StartTime   = min(TimeGenerated),
    EndTime     = max(TimeGenerated),
    TotalHits   = count(),
    MaxSeverity = max(Severity),
    Actions     = make_set(Action, 5),
    Signatures  = make_set(SignatureId, 20),
    Description = make_set(substring(tostring(Description), 0, 120), 3)
    by SourceIp, ThreatCategory = Category
| where TotalHits >= HitThreshold
| project
    StartTime,
    EndTime,
    SourceIp,
    ThreatCategory,
    TotalHits,
    MaxSeverity,
    Actions,
    Signatures,
    Description
| order by MaxSeverity desc, TotalHits desc

YAML

id: 7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a
severity: High
queryPeriod: 24h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Firewall/Analytic%20Rules/Azure%20Firewall%20-%20Elevation%20of%20Privilege%20attempt%20detected.yaml
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - AZFWIdpsSignature
  connectorId: AzureFirewall
triggerThreshold: 0
status: Available
relevantTechniques:
- T1078
- T1110
entityMappings:
- fieldMappings:
  - columnName: SourceIp
    identifier: Address
  entityType: IP
name: Elevation of Privilege attempt detected
query: |
  let TimeWindow   = 90d;    // How far back to look 
  let HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category
  let MinSeverity  = 1;      // Set Minimum Severity
  // Feature flags for optional filters
  let EnableCategoryFilter    = true;   // Filter 1
  let EnableDescriptionFilter = false;  // Filter 2
  let EnableActionFilter      = false;  // Filter 3
  // Filter 1: Categories of interest
  let CategoriesOfInterest = dynamic([
      "Attempted User Privilege Gain",
      "Unsuccessful User Privilege Gain",
      "Successful User Privilege Gain",
      "Attempted Administrator Privilege Gain",
      "Successful Administrator Privilege Gain"
  ]);
  // Filter 2: Descriptions of interest
  let DescriptionsOfInterest = dynamic([
      "attempted-user",
      "unsuccessful-user",
      "successful-user",
      "attempted-admin",
      "successful-admin"
  ]);
  // Filter 3: Action match
  let MatchActions = dynamic(["Deny", "alert"]);
  AZFWIdpsSignature
  | where TimeGenerated >= ago(TimeWindow)
  | where Severity >= MinSeverity
  // Filter 1: Category filter (optional)
  | where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))
  // Filter 2: Description filter (optional)
  | where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))
  // Filter 3: Action filter (optional)
  | where (EnableActionFilter == false) or (Action in~ (MatchActions))
  | summarize
      StartTime   = min(TimeGenerated),
      EndTime     = max(TimeGenerated),
      TotalHits   = count(),
      MaxSeverity = max(Severity),
      Actions     = make_set(Action, 5),
      Signatures  = make_set(SignatureId, 20),
      Description = make_set(substring(tostring(Description), 0, 120), 3)
      by SourceIp, ThreatCategory = Category
  | where TotalHits >= HitThreshold
  | project
      StartTime,
      EndTime,
      SourceIp,
      ThreatCategory,
      TotalHits,
      MaxSeverity,
      Actions,
      Signatures,
      Description
  | order by MaxSeverity desc, TotalHits desc
queryFrequency: 1h
version: 1.0.1
description: |
  Identifies Elevation of Privilege attempt Azure Firewall IDPS logs.
tactics:
- InitialAccess
- CredentialAccess
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a')]",
      "properties": {
        "alertRuleTemplateName": "7a0f78b3-9a55-4ad0-a56d-b6616fdbff6a",
        "customDetails": null,
        "description": "Identifies Elevation of Privilege attempt Azure Firewall IDPS logs.\n",
        "displayName": "Elevation of Privilege attempt detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Firewall/Analytic%20Rules/Azure%20Firewall%20-%20Elevation%20of%20Privilege%20attempt%20detected.yaml",
        "query": "let TimeWindow   = 90d;    // How far back to look \nlet HitThreshold = 10;     // Minimum hits to alert per SourceIp + Category\nlet MinSeverity  = 1;      // Set Minimum Severity\n// Feature flags for optional filters\nlet EnableCategoryFilter    = true;   // Filter 1\nlet EnableDescriptionFilter = false;  // Filter 2\nlet EnableActionFilter      = false;  // Filter 3\n// Filter 1: Categories of interest\nlet CategoriesOfInterest = dynamic([\n    \"Attempted User Privilege Gain\",\n    \"Unsuccessful User Privilege Gain\",\n    \"Successful User Privilege Gain\",\n    \"Attempted Administrator Privilege Gain\",\n    \"Successful Administrator Privilege Gain\"\n]);\n// Filter 2: Descriptions of interest\nlet DescriptionsOfInterest = dynamic([\n    \"attempted-user\",\n    \"unsuccessful-user\",\n    \"successful-user\",\n    \"attempted-admin\",\n    \"successful-admin\"\n]);\n// Filter 3: Action match\nlet MatchActions = dynamic([\"Deny\", \"alert\"]);\nAZFWIdpsSignature\n| where TimeGenerated >= ago(TimeWindow)\n| where Severity >= MinSeverity\n// Filter 1: Category filter (optional)\n| where (EnableCategoryFilter == false) or (Category has_any (CategoriesOfInterest))\n// Filter 2: Description filter (optional)\n| where (EnableDescriptionFilter == false) or (Description has_any (DescriptionsOfInterest))\n// Filter 3: Action filter (optional)\n| where (EnableActionFilter == false) or (Action in~ (MatchActions))\n| summarize\n    StartTime   = min(TimeGenerated),\n    EndTime     = max(TimeGenerated),\n    TotalHits   = count(),\n    MaxSeverity = max(Severity),\n    Actions     = make_set(Action, 5),\n    Signatures  = make_set(SignatureId, 20),\n    Description = make_set(substring(tostring(Description), 0, 120), 3)\n    by SourceIp, ThreatCategory = Category\n| where TotalHits >= HitThreshold\n| project\n    StartTime,\n    EndTime,\n    SourceIp,\n    ThreatCategory,\n    TotalHits,\n    MaxSeverity,\n    Actions,\n    Signatures,\n    Description\n| order by MaxSeverity desc, TotalHits desc\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT24H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1110"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}