Service Principal Assigned Privileged Role
| Id | 84cccc86-5c11-4b3a-aca6-7c8f738ed0f7 |
| Rulename | Service Principal Assigned Privileged Role |
| Description | Detects a privileged role being added to a Service Principal. Ensure that any assignment to a Service Principal is valid and appropriate - Service Principals should not be assigned to very highly privileged roles such as Global Admin. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts |
| Severity | Medium |
| Tactics | PrivilegeEscalation |
| Techniques | T1078.004 |
| Required data connectors | AzureActiveDirectory |
| Kind | Scheduled |
| Query frequency | 1d |
| Query period | 1d |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ServicePrincipalAssignedPrivilegedRole.yaml |
| Version | 1.0.1 |
| Arm template | 84cccc86-5c11-4b3a-aca6-7c8f738ed0f7.json |
AuditLogs
| where OperationName has_all ("member to role", "add")
| where Result =~ "Success"
| extend type_ = tostring(TargetResources[0].type)
| where type_ =~ "ServicePrincipal"
| where isnotempty(TargetResources)
| extend ServicePrincipal = tostring(TargetResources[0].displayName)
| extend SPID = tostring(TargetResources[0].id)
| mv-expand TargetResources[0].modifiedProperties
| extend TargetResources_0_modifiedProperties = columnifexists("TargetResources_0_modifiedProperties", '')
| where isnotempty(TargetResources_0_modifiedProperties)
| where TargetResources_0_modifiedProperties.displayName =~ "Role.DisplayName"
| extend TargetRole = parse_json(tostring(TargetResources_0_modifiedProperties.newValue))
| where TargetRole contains "admin"
| extend AddedByApp = iif(
isnotempty(tostring(parse_json(tostring(InitiatedBy.app)).servicePrincipalName)),
tostring(parse_json(tostring(InitiatedBy.app)).servicePrincipalName),
tostring(parse_json(tostring(InitiatedBy.app)).displayName)
)
| extend AddedByUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| extend AddedBy = iif(isnotempty(AddedByApp), AddedByApp, AddedByUser)
| extend IpAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
| project-reorder TimeGenerated, ServicePrincipal, SPID, TargetRole, AddedBy, IpAddress
| project-away AddedByApp, AddedByUser
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ServicePrincipalAssignedPrivilegedRole.yaml
entityMappings:
- fieldMappings:
- identifier: AadUserId
columnName: SPID
entityType: Account
- fieldMappings:
- identifier: FullName
columnName: AddedBy
entityType: Account
kind: Scheduled
query: |
AuditLogs
| where OperationName has_all ("member to role", "add")
| where Result =~ "Success"
| extend type_ = tostring(TargetResources[0].type)
| where type_ =~ "ServicePrincipal"
| where isnotempty(TargetResources)
| extend ServicePrincipal = tostring(TargetResources[0].displayName)
| extend SPID = tostring(TargetResources[0].id)
| mv-expand TargetResources[0].modifiedProperties
| extend TargetResources_0_modifiedProperties = columnifexists("TargetResources_0_modifiedProperties", '')
| where isnotempty(TargetResources_0_modifiedProperties)
| where TargetResources_0_modifiedProperties.displayName =~ "Role.DisplayName"
| extend TargetRole = parse_json(tostring(TargetResources_0_modifiedProperties.newValue))
| where TargetRole contains "admin"
| extend AddedByApp = iif(
isnotempty(tostring(parse_json(tostring(InitiatedBy.app)).servicePrincipalName)),
tostring(parse_json(tostring(InitiatedBy.app)).servicePrincipalName),
tostring(parse_json(tostring(InitiatedBy.app)).displayName)
)
| extend AddedByUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| extend AddedBy = iif(isnotempty(AddedByApp), AddedByApp, AddedByUser)
| extend IpAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
| project-reorder TimeGenerated, ServicePrincipal, SPID, TargetRole, AddedBy, IpAddress
| project-away AddedByApp, AddedByUser
triggerOperator: gt
version: 1.0.1
queryPeriod: 1d
name: Service Principal Assigned Privileged Role
metadata:
categories:
domains:
- Security - Others
- Identity
support:
tier: Community
source:
kind: Community
author:
name: Pete Bryan
severity: Medium
relevantTechniques:
- T1078.004
requiredDataConnectors:
- dataTypes:
- AuditLogs
connectorId: AzureActiveDirectory
triggerThreshold: 0
tactics:
- PrivilegeEscalation
queryFrequency: 1d
tags:
- AADSecOpsGuide
id: 84cccc86-5c11-4b3a-aca6-7c8f738ed0f7
description: |
'Detects a privileged role being added to a Service Principal.
Ensure that any assignment to a Service Principal is valid and appropriate - Service Principals should not be assigned to very highly privileged roles such as Global Admin.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts'
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2023-02-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/84cccc86-5c11-4b3a-aca6-7c8f738ed0f7')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/84cccc86-5c11-4b3a-aca6-7c8f738ed0f7')]",
"properties": {
"alertRuleTemplateName": "84cccc86-5c11-4b3a-aca6-7c8f738ed0f7",
"customDetails": null,
"description": "'Detects a privileged role being added to a Service Principal.\n Ensure that any assignment to a Service Principal is valid and appropriate - Service Principals should not be assigned to very highly privileged roles such as Global Admin.\n Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts'\n",
"displayName": "Service Principal Assigned Privileged Role",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "SPID",
"identifier": "AadUserId"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "AddedBy",
"identifier": "FullName"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ServicePrincipalAssignedPrivilegedRole.yaml",
"query": "AuditLogs\n | where OperationName has_all (\"member to role\", \"add\")\n | where Result =~ \"Success\"\n | extend type_ = tostring(TargetResources[0].type)\n | where type_ =~ \"ServicePrincipal\"\n | where isnotempty(TargetResources)\n | extend ServicePrincipal = tostring(TargetResources[0].displayName)\n | extend SPID = tostring(TargetResources[0].id)\n | mv-expand TargetResources[0].modifiedProperties\n | extend TargetResources_0_modifiedProperties = columnifexists(\"TargetResources_0_modifiedProperties\", '')\n | where isnotempty(TargetResources_0_modifiedProperties)\n | where TargetResources_0_modifiedProperties.displayName =~ \"Role.DisplayName\"\n | extend TargetRole = parse_json(tostring(TargetResources_0_modifiedProperties.newValue))\n | where TargetRole contains \"admin\"\n | extend AddedByApp = iif(\n isnotempty(tostring(parse_json(tostring(InitiatedBy.app)).servicePrincipalName)),\n tostring(parse_json(tostring(InitiatedBy.app)).servicePrincipalName),\n tostring(parse_json(tostring(InitiatedBy.app)).displayName)\n )\n | extend AddedByUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\n | extend AddedBy = iif(isnotempty(AddedByApp), AddedByApp, AddedByUser)\n | extend IpAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)\n | project-reorder TimeGenerated, ServicePrincipal, SPID, TargetRole, AddedBy, IpAddress\n | project-away AddedByApp, AddedByUser\n",
"queryFrequency": "P1D",
"queryPeriod": "P1D",
"severity": "Medium",
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"PrivilegeEscalation"
],
"tags": [
"AADSecOpsGuide"
],
"techniques": [
"T1078"
],
"templateVersion": "1.0.1",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}