Analytic rule catalog
[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions
Back
| Id | 90bacdf4-e35b-47cb-92d1-29d8397eb4a0 |
| Rulename | [Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions |
| Description | Detects an application receiving administrator permissions and then using them to assign a role. This pattern can indicate rapid privilege escalation through app consent abuse. |
| Severity | High |
| Tactics | Persistence PrivilegeEscalation DefenseEvasion InitialAccess |
| Techniques | T1078.004 T1098.003 |
| Required data connectors | AzureActiveDirectory |
| Kind | Scheduled |
| Query frequency | 1h |
| Query period | 2h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Application%20Assigned%20Administrator%20Permissions%20Immediately%20After%20Obtaining%20Role%20Management%20Permissions.yaml |
| Version | 1.0.0 |
| Arm template | 90bacdf4-e35b-47cb-92d1-29d8397eb4a0.json |
let query_frequency = 1h;
let query_period = 2h;
AuditLogs
| where TimeGenerated > ago(query_period)
| where Category =~ "ApplicationManagement" and LoggedByService =~ "Core Directory"
| where OperationName =~ "Add app role assignment to service principal"
| mv-expand TargetResource = TargetResources
| mv-expand modifiedProperty = TargetResource["modifiedProperties"]
| where tostring(modifiedProperty["displayName"]) == "AppRole.Value"
| extend PermissionGrant = tostring(modifiedProperty["newValue"])
| where PermissionGrant has "RoleManagement.ReadWrite.Directory"
| mv-apply modifiedProperty = TargetResource["modifiedProperties"] on (
summarize modifiedProperties = make_bag(
bag_pack(
tostring(modifiedProperty["displayName"]),
bag_pack(
"oldValue",
trim(@'[\"\s]+', tostring(modifiedProperty["oldValue"])),
"newValue",
trim(@'[\"\s]+', tostring(modifiedProperty["newValue"]))
)
),
100
)
)
| project
PermissionGrant_TimeGenerated = TimeGenerated,
PermissionGrant_OperationName = OperationName,
PermissionGrant_Result = Result,
PermissionGrant,
AppDisplayName = tostring(modifiedProperties["ServicePrincipal.DisplayName"]["newValue"]),
AppServicePrincipalId = tostring(modifiedProperties["ServicePrincipal.ObjectID"]["newValue"]),
PermissionGrant_InitiatedBy = InitiatedBy,
PermissionGrant_TargetResources = TargetResources,
PermissionGrant_AdditionalDetails = AdditionalDetails,
PermissionGrant_CorrelationId = CorrelationId
| join kind=inner (
AuditLogs
| where TimeGenerated > ago(query_frequency)
| where Category =~ "RoleManagement"
and LoggedByService =~ "Core Directory"
and AADOperationType =~ "Assign"
| where isnotempty(InitiatedBy["app"])
| mv-expand TargetResource = TargetResources
| mv-expand modifiedProperty = TargetResource["modifiedProperties"]
| where tostring(modifiedProperty["displayName"]) in ("Role.DisplayName", "RoleDefinition.DisplayName")
| extend RoleAssignment = tostring(modifiedProperty["newValue"])
| where RoleAssignment contains "Admin"
| project
RoleAssignment_TimeGenerated = TimeGenerated,
RoleAssignment_OperationName = OperationName,
RoleAssignment_Result = Result,
RoleAssignment,
TargetType = tostring(TargetResources[0]["type"]),
Target = iff(isnotempty(TargetResources[0]["displayName"]), tostring(TargetResources[0]["displayName"]), tolower(TargetResources[0]["userPrincipalName"])),
TargetId = tostring(TargetResources[0]["id"]),
RoleAssignment_InitiatedBy = InitiatedBy,
RoleAssignment_TargetResources = TargetResources,
RoleAssignment_AdditionalDetails = AdditionalDetails,
RoleAssignment_CorrelationId = CorrelationId,
AppServicePrincipalId = tostring(InitiatedBy["app"]["servicePrincipalId"])
)
on AppServicePrincipalId
| where PermissionGrant_TimeGenerated < RoleAssignment_TimeGenerated
| extend
TargetName = tostring(split(Target, "@")[0]),
TargetUPNSuffix = tostring(split(Target, "@")[1])
| project
Alert_Category_en = "Entra ID",
Alert_SubCategory_en = "Anomaly Identity Privilege Modification",
Alert_Name_en = "Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions",
Alert_Description_en = strcat(
"At Taiwan time",
format_datetime(datetime_utc_to_local(RoleAssignment_TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
". ",
"EntraID:",
"",
". ",
"detected initiator: ",
tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
" granted application: ",
AppDisplayName,
" permission: ",
PermissionGrant,
"afterward, the application immediately assigned a role to target: ",
Target,
"role assignment: ",
RoleAssignment
),
Alert_TriageStep_en = strcat(
"1. Confirm initiator: ",
tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
"IP:",
tostring(PermissionGrant_InitiatedBy.ipAddress),
", and review the authorized application: ",
AppDisplayName,
", obtained permission: ",
PermissionGrant,
", to determine whether it is expected behavior/automation. ",
"2. Review application: ",
AppDisplayName,
" for target: ",
Target,
" role assignment content: ",
RoleAssignment,
", to determine whether it is expected behavior/automation. "
),
Alert_Containment_en = strcat(
"1. If determined to be unauthorized behavior, immediately disable initiator: ",
tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
" and application: ",
AppDisplayName,
", and revoke its Directory/RoleManagement-related permissions. ",
"2. Immediately revert/remove the improper administrator role assignment: ",
Target,
", and review whether other role/group/application assignments were changed."
),
Alert_Remediation_en =
"1. Strengthen Conditional Access and account governance: enforce MFA/managed device and named location restrictions for administrator accounts, and block abnormal IPs. "
"2. Implement least privilege and PIM: use Just-In-Time (JIT) activation with approval for administrator roles to reduce the risk of immediate abuse after account compromise. "
"3. Strengthen detection and automation: establish automated response SOAR (notification/revoke authorization/disable application/revert role/block source).",
Alert_Time_TW = datetime_utc_to_local(RoleAssignment_TimeGenerated, "Asia/Taipei"),
Alert_Time_UTC0 = RoleAssignment_TimeGenerated,
Event_Action = RoleAssignment_OperationName,
Event_Status = RoleAssignment_Result,
Event_Description = strcat("initiator: ", tostring(PermissionGrant_InitiatedBy.user.userPrincipalName), " to application: ", AppDisplayName, ", ", PermissionGrant_OperationName, ". Subsequently, application: ", AppDisplayName, " for target ", Target, ", ", RoleAssignment_OperationName),
Source_Identity_FullName = AppDisplayName,
Source_Identity_ID = AppServicePrincipalId,
Source_Identity_Type = "Service",
Target_Identity_FullName = Target,
Target_Identity_ID = TargetId,
Target_Identity_Name = TargetName,
Target_Identity_Type = iff(TargetType has "User", "User", "Service"),
Target_Resource_ID = "",
Target_Resource_Name = "Microsoft Entra ID",
Target_Resource_Type = "Microsoft Entra ID"
entityMappings:
- entityType: Account
fieldMappings:
- columnName: Source_Identity_FullName
identifier: FullName
- entityType: CloudApplication
fieldMappings:
- columnName: Target_Identity_FullName
identifier: Name
query: |
let query_frequency = 1h;
let query_period = 2h;
AuditLogs
| where TimeGenerated > ago(query_period)
| where Category =~ "ApplicationManagement" and LoggedByService =~ "Core Directory"
| where OperationName =~ "Add app role assignment to service principal"
| mv-expand TargetResource = TargetResources
| mv-expand modifiedProperty = TargetResource["modifiedProperties"]
| where tostring(modifiedProperty["displayName"]) == "AppRole.Value"
| extend PermissionGrant = tostring(modifiedProperty["newValue"])
| where PermissionGrant has "RoleManagement.ReadWrite.Directory"
| mv-apply modifiedProperty = TargetResource["modifiedProperties"] on (
summarize modifiedProperties = make_bag(
bag_pack(
tostring(modifiedProperty["displayName"]),
bag_pack(
"oldValue",
trim(@'[\"\s]+', tostring(modifiedProperty["oldValue"])),
"newValue",
trim(@'[\"\s]+', tostring(modifiedProperty["newValue"]))
)
),
100
)
)
| project
PermissionGrant_TimeGenerated = TimeGenerated,
PermissionGrant_OperationName = OperationName,
PermissionGrant_Result = Result,
PermissionGrant,
AppDisplayName = tostring(modifiedProperties["ServicePrincipal.DisplayName"]["newValue"]),
AppServicePrincipalId = tostring(modifiedProperties["ServicePrincipal.ObjectID"]["newValue"]),
PermissionGrant_InitiatedBy = InitiatedBy,
PermissionGrant_TargetResources = TargetResources,
PermissionGrant_AdditionalDetails = AdditionalDetails,
PermissionGrant_CorrelationId = CorrelationId
| join kind=inner (
AuditLogs
| where TimeGenerated > ago(query_frequency)
| where Category =~ "RoleManagement"
and LoggedByService =~ "Core Directory"
and AADOperationType =~ "Assign"
| where isnotempty(InitiatedBy["app"])
| mv-expand TargetResource = TargetResources
| mv-expand modifiedProperty = TargetResource["modifiedProperties"]
| where tostring(modifiedProperty["displayName"]) in ("Role.DisplayName", "RoleDefinition.DisplayName")
| extend RoleAssignment = tostring(modifiedProperty["newValue"])
| where RoleAssignment contains "Admin"
| project
RoleAssignment_TimeGenerated = TimeGenerated,
RoleAssignment_OperationName = OperationName,
RoleAssignment_Result = Result,
RoleAssignment,
TargetType = tostring(TargetResources[0]["type"]),
Target = iff(isnotempty(TargetResources[0]["displayName"]), tostring(TargetResources[0]["displayName"]), tolower(TargetResources[0]["userPrincipalName"])),
TargetId = tostring(TargetResources[0]["id"]),
RoleAssignment_InitiatedBy = InitiatedBy,
RoleAssignment_TargetResources = TargetResources,
RoleAssignment_AdditionalDetails = AdditionalDetails,
RoleAssignment_CorrelationId = CorrelationId,
AppServicePrincipalId = tostring(InitiatedBy["app"]["servicePrincipalId"])
)
on AppServicePrincipalId
| where PermissionGrant_TimeGenerated < RoleAssignment_TimeGenerated
| extend
TargetName = tostring(split(Target, "@")[0]),
TargetUPNSuffix = tostring(split(Target, "@")[1])
| project
Alert_Category_en = "Entra ID",
Alert_SubCategory_en = "Anomaly Identity Privilege Modification",
Alert_Name_en = "Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions",
Alert_Description_en = strcat(
"At Taiwan time",
format_datetime(datetime_utc_to_local(RoleAssignment_TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
". ",
"EntraID:",
"",
". ",
"detected initiator: ",
tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
" granted application: ",
AppDisplayName,
" permission: ",
PermissionGrant,
"afterward, the application immediately assigned a role to target: ",
Target,
"role assignment: ",
RoleAssignment
),
Alert_TriageStep_en = strcat(
"1. Confirm initiator: ",
tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
"IP:",
tostring(PermissionGrant_InitiatedBy.ipAddress),
", and review the authorized application: ",
AppDisplayName,
", obtained permission: ",
PermissionGrant,
", to determine whether it is expected behavior/automation. ",
"2. Review application: ",
AppDisplayName,
" for target: ",
Target,
" role assignment content: ",
RoleAssignment,
", to determine whether it is expected behavior/automation. "
),
Alert_Containment_en = strcat(
"1. If determined to be unauthorized behavior, immediately disable initiator: ",
tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),
" and application: ",
AppDisplayName,
", and revoke its Directory/RoleManagement-related permissions. ",
"2. Immediately revert/remove the improper administrator role assignment: ",
Target,
", and review whether other role/group/application assignments were changed."
),
Alert_Remediation_en =
"1. Strengthen Conditional Access and account governance: enforce MFA/managed device and named location restrictions for administrator accounts, and block abnormal IPs. "
"2. Implement least privilege and PIM: use Just-In-Time (JIT) activation with approval for administrator roles to reduce the risk of immediate abuse after account compromise. "
"3. Strengthen detection and automation: establish automated response SOAR (notification/revoke authorization/disable application/revert role/block source).",
Alert_Time_TW = datetime_utc_to_local(RoleAssignment_TimeGenerated, "Asia/Taipei"),
Alert_Time_UTC0 = RoleAssignment_TimeGenerated,
Event_Action = RoleAssignment_OperationName,
Event_Status = RoleAssignment_Result,
Event_Description = strcat("initiator: ", tostring(PermissionGrant_InitiatedBy.user.userPrincipalName), " to application: ", AppDisplayName, ", ", PermissionGrant_OperationName, ". Subsequently, application: ", AppDisplayName, " for target ", Target, ", ", RoleAssignment_OperationName),
Source_Identity_FullName = AppDisplayName,
Source_Identity_ID = AppServicePrincipalId,
Source_Identity_Type = "Service",
Target_Identity_FullName = Target,
Target_Identity_ID = TargetId,
Target_Identity_Name = TargetName,
Target_Identity_Type = iff(TargetType has "User", "User", "Service"),
Target_Resource_ID = "",
Target_Resource_Name = "Microsoft Entra ID",
Target_Resource_Type = "Microsoft Entra ID"
id: 90bacdf4-e35b-47cb-92d1-29d8397eb4a0
queryFrequency: 1h
alertDetailsOverride:
alertDynamicProperties: []
status: Available
severity: High
relevantTechniques:
- T1078.004
- T1098.003
version: 1.0.0
kind: Scheduled
tactics:
- Persistence
- PrivilegeEscalation
- DefenseEvasion
- InitialAccess
requiredDataConnectors:
- dataTypes:
- AuditLogs
connectorId: AzureActiveDirectory
description: |
Detects an application receiving administrator permissions and then using them to assign a role. This pattern can indicate rapid privilege escalation through app consent abuse.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Application%20Assigned%20Administrator%20Permissions%20Immediately%20After%20Obtaining%20Role%20Management%20Permissions.yaml
triggerOperator: gt
name: '[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions'
triggerThreshold: 0
queryPeriod: 2h
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/90bacdf4-e35b-47cb-92d1-29d8397eb4a0')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/90bacdf4-e35b-47cb-92d1-29d8397eb4a0')]",
"properties": {
"alertDetailsOverride": {
"alertDynamicProperties": []
},
"alertRuleTemplateName": "90bacdf4-e35b-47cb-92d1-29d8397eb4a0",
"customDetails": null,
"description": "Detects an application receiving administrator permissions and then using them to assign a role. This pattern can indicate rapid privilege escalation through app consent abuse.\n",
"displayName": "[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Source_Identity_FullName",
"identifier": "FullName"
}
]
},
{
"entityType": "CloudApplication",
"fieldMappings": [
{
"columnName": "Target_Identity_FullName",
"identifier": "Name"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Application%20Assigned%20Administrator%20Permissions%20Immediately%20After%20Obtaining%20Role%20Management%20Permissions.yaml",
"query": "let query_frequency = 1h;\nlet query_period = 2h;\nAuditLogs\n| where TimeGenerated > ago(query_period)\n| where Category =~ \"ApplicationManagement\" and LoggedByService =~ \"Core Directory\"\n| where OperationName =~ \"Add app role assignment to service principal\"\n| mv-expand TargetResource = TargetResources\n| mv-expand modifiedProperty = TargetResource[\"modifiedProperties\"]\n| where tostring(modifiedProperty[\"displayName\"]) == \"AppRole.Value\"\n| extend PermissionGrant = tostring(modifiedProperty[\"newValue\"])\n| where PermissionGrant has \"RoleManagement.ReadWrite.Directory\"\n| mv-apply modifiedProperty = TargetResource[\"modifiedProperties\"] on (\n summarize modifiedProperties = make_bag(\n bag_pack(\n tostring(modifiedProperty[\"displayName\"]),\n bag_pack(\n \"oldValue\",\n trim(@'[\\\"\\s]+', tostring(modifiedProperty[\"oldValue\"])),\n \"newValue\",\n trim(@'[\\\"\\s]+', tostring(modifiedProperty[\"newValue\"]))\n)\n),\n 100\n )\n )\n| project\n PermissionGrant_TimeGenerated = TimeGenerated,\n PermissionGrant_OperationName = OperationName,\n PermissionGrant_Result = Result,\n PermissionGrant,\n AppDisplayName = tostring(modifiedProperties[\"ServicePrincipal.DisplayName\"][\"newValue\"]),\n AppServicePrincipalId = tostring(modifiedProperties[\"ServicePrincipal.ObjectID\"][\"newValue\"]),\n PermissionGrant_InitiatedBy = InitiatedBy,\n PermissionGrant_TargetResources = TargetResources,\n PermissionGrant_AdditionalDetails = AdditionalDetails,\n PermissionGrant_CorrelationId = CorrelationId\n| join kind=inner (\n AuditLogs\n | where TimeGenerated > ago(query_frequency)\n | where Category =~ \"RoleManagement\"\n and LoggedByService =~ \"Core Directory\"\n and AADOperationType =~ \"Assign\"\n | where isnotempty(InitiatedBy[\"app\"])\n | mv-expand TargetResource = TargetResources\n | mv-expand modifiedProperty = TargetResource[\"modifiedProperties\"]\n | where tostring(modifiedProperty[\"displayName\"]) in (\"Role.DisplayName\", \"RoleDefinition.DisplayName\")\n | extend RoleAssignment = tostring(modifiedProperty[\"newValue\"])\n | where RoleAssignment contains \"Admin\"\n | project\n RoleAssignment_TimeGenerated = TimeGenerated,\n RoleAssignment_OperationName = OperationName,\n RoleAssignment_Result = Result,\n RoleAssignment,\n TargetType = tostring(TargetResources[0][\"type\"]),\n Target = iff(isnotempty(TargetResources[0][\"displayName\"]), tostring(TargetResources[0][\"displayName\"]), tolower(TargetResources[0][\"userPrincipalName\"])),\n TargetId = tostring(TargetResources[0][\"id\"]),\n RoleAssignment_InitiatedBy = InitiatedBy,\n RoleAssignment_TargetResources = TargetResources,\n RoleAssignment_AdditionalDetails = AdditionalDetails,\n RoleAssignment_CorrelationId = CorrelationId,\n AppServicePrincipalId = tostring(InitiatedBy[\"app\"][\"servicePrincipalId\"])\n )\n on AppServicePrincipalId\n| where PermissionGrant_TimeGenerated < RoleAssignment_TimeGenerated\n| extend\n TargetName = tostring(split(Target, \"@\")[0]),\n TargetUPNSuffix = tostring(split(Target, \"@\")[1])\n| project\n Alert_Category_en = \"Entra ID\",\n Alert_SubCategory_en = \"Anomaly Identity Privilege Modification\",\n Alert_Name_en = \"Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions\",\n Alert_Description_en = strcat(\n \"At Taiwan time\",\n format_datetime(datetime_utc_to_local(RoleAssignment_TimeGenerated, \"Asia/Taipei\"), \"yyyy-MM-dd HH:mm:ss\"),\n \". \",\n \"EntraID:\",\n \"\",\n \". \",\n \"detected initiator: \",\n tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),\n \" granted application: \",\n AppDisplayName,\n \" permission: \",\n PermissionGrant,\n \"afterward, the application immediately assigned a role to target: \",\n Target,\n \"role assignment: \",\n RoleAssignment\n ),\n Alert_TriageStep_en = strcat(\n \"1. Confirm initiator: \",\n tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),\n \"IP:\",\n tostring(PermissionGrant_InitiatedBy.ipAddress),\n \", and review the authorized application: \",\n AppDisplayName,\n \", obtained permission: \",\n PermissionGrant,\n \", to determine whether it is expected behavior/automation. \",\n \"2. Review application: \",\n AppDisplayName,\n \" for target: \",\n Target,\n \" role assignment content: \",\n RoleAssignment,\n \", to determine whether it is expected behavior/automation. \"\n ),\n Alert_Containment_en = strcat(\n \"1. If determined to be unauthorized behavior, immediately disable initiator: \",\n tostring(PermissionGrant_InitiatedBy.user.userPrincipalName),\n \" and application: \",\n AppDisplayName,\n \", and revoke its Directory/RoleManagement-related permissions. \",\n \"2. Immediately revert/remove the improper administrator role assignment: \",\n Target,\n \", and review whether other role/group/application assignments were changed.\"\n ),\n Alert_Remediation_en =\n \"1. Strengthen Conditional Access and account governance: enforce MFA/managed device and named location restrictions for administrator accounts, and block abnormal IPs. \"\n \"2. Implement least privilege and PIM: use Just-In-Time (JIT) activation with approval for administrator roles to reduce the risk of immediate abuse after account compromise. \"\n \"3. Strengthen detection and automation: establish automated response SOAR (notification/revoke authorization/disable application/revert role/block source).\",\n Alert_Time_TW = datetime_utc_to_local(RoleAssignment_TimeGenerated, \"Asia/Taipei\"),\n Alert_Time_UTC0 = RoleAssignment_TimeGenerated,\n Event_Action = RoleAssignment_OperationName,\n Event_Status = RoleAssignment_Result,\n Event_Description = strcat(\"initiator: \", tostring(PermissionGrant_InitiatedBy.user.userPrincipalName), \" to application: \", AppDisplayName, \", \", PermissionGrant_OperationName, \". Subsequently, application: \", AppDisplayName, \" for target \", Target, \", \", RoleAssignment_OperationName),\n Source_Identity_FullName = AppDisplayName,\n Source_Identity_ID = AppServicePrincipalId,\n Source_Identity_Type = \"Service\",\n Target_Identity_FullName = Target,\n Target_Identity_ID = TargetId,\n Target_Identity_Name = TargetName,\n Target_Identity_Type = iff(TargetType has \"User\", \"User\", \"Service\"),\n Target_Resource_ID = \"\",\n Target_Resource_Name = \"Microsoft Entra ID\",\n Target_Resource_Type = \"Microsoft Entra ID\"\n",
"queryFrequency": "PT1H",
"queryPeriod": "PT2H",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1078.004",
"T1098.003"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion",
"InitialAccess",
"Persistence",
"PrivilegeEscalation"
],
"techniques": [
"T1078",
"T1098"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}