Silverfort - Privileged group membership addition | Microsoft Sentinel Analytic Rules

Back


Id	99820a41-1d19-5fcc-81df-0f71c64069b6
Rulename	Silverfort - Privileged group membership addition
Description	Identifies Silverfort incidents involving an account being added to a privileged group. An unexpected membership change may grant elevated access and indicate privilege escalation or persistence.
Severity	High
Tactics	Persistence PrivilegeEscalation
Techniques	T1098.007
Required data connectors	SilverfortAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/PrivilegedGroupMemberAddition.yaml
Version	1.0.0
Arm template	99820a41-1d19-5fcc-81df-0f71c64069b6.json

KQL

CommonSecurityLog
| where DeviceVendor has 'Silverfort'
| where DeviceProduct has 'Admin Console'
| where DeviceEventClassID == "NewIncident"
| where Message has "PrivilegedGroupMemberAddition"
| extend IncidentData = parse_json(replace('^""|""$', '', Message))
| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
| extend UserName = coalesce(
    tostring(IncidentData.data.users[0].samAccountName),
    tostring(IncidentData.data.users[0].upn),
    tostring(IncidentData.data.users[0].displayName),
    tostring(IncidentData.users[0].displayName)
)
| extend SourceHost = coalesce(
    tostring(IncidentData.data.sources[0].displayName),
    tostring(IncidentData.sources[0].displayName)
)
| extend DestinationHost = coalesce(
    tostring(IncidentData.data.destinations[0].displayName),
    tostring(IncidentData.destinations[0].displayName)
)

YAML

triggerThreshold: 0
customDetails:
  IncidentReference: IncidentId
  IncidentSummary: IncidentSummary
  IncidentKind: IncidentKind
tactics:
- Persistence
- PrivilegeEscalation
status: Available
queryPeriod: 15m
queryFrequency: 15m
requiredDataConnectors:
- connectorId: SilverfortAma
  dataTypes:
  - CommonSecurityLog
query: |-
  CommonSecurityLog
  | where DeviceVendor has 'Silverfort'
  | where DeviceProduct has 'Admin Console'
  | where DeviceEventClassID == "NewIncident"
  | where Message has "PrivilegedGroupMemberAddition"
  | extend IncidentData = parse_json(replace('^""|""$', '', Message))
  | extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))
  | extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))
  | extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))
  | extend UserName = coalesce(
      tostring(IncidentData.data.users[0].samAccountName),
      tostring(IncidentData.data.users[0].upn),
      tostring(IncidentData.data.users[0].displayName),
      tostring(IncidentData.users[0].displayName)
  )
  | extend SourceHost = coalesce(
      tostring(IncidentData.data.sources[0].displayName),
      tostring(IncidentData.sources[0].displayName)
  )
  | extend DestinationHost = coalesce(
      tostring(IncidentData.data.destinations[0].displayName),
      tostring(IncidentData.destinations[0].displayName)
  )
relevantTechniques:
- T1098.007
name: Silverfort - Privileged group membership addition
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/PrivilegedGroupMemberAddition.yaml
severity: High
description: |
  Identifies Silverfort incidents involving an account being added to a privileged group. An unexpected membership change may grant elevated access and indicate privilege escalation or persistence.
triggerOperator: gt
id: 99820a41-1d19-5fcc-81df-0f71c64069b6
version: 1.0.0
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserName
    identifier: Name
- entityType: Host
  fieldMappings:
  - columnName: SourceHost
    identifier: HostName
- entityType: Host
  fieldMappings:
  - columnName: DestinationHost
    identifier: HostName

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/99820a41-1d19-5fcc-81df-0f71c64069b6')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/99820a41-1d19-5fcc-81df-0f71c64069b6')]",
      "properties": {
        "alertRuleTemplateName": "99820a41-1d19-5fcc-81df-0f71c64069b6",
        "customDetails": {
          "IncidentKind": "IncidentKind",
          "IncidentReference": "IncidentId",
          "IncidentSummary": "IncidentSummary"
        },
        "description": "Identifies Silverfort incidents involving an account being added to a privileged group. An unexpected membership change may grant elevated access and indicate privilege escalation or persistence.\n",
        "displayName": "Silverfort - Privileged group membership addition",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHost",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DestinationHost",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic%20Rules/PrivilegedGroupMemberAddition.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor has 'Silverfort'\n| where DeviceProduct has 'Admin Console'\n| where DeviceEventClassID == \"NewIncident\"\n| where Message has \"PrivilegedGroupMemberAddition\"\n| extend IncidentData = parse_json(replace('^\"\"|\"\"$', '', Message))\n| extend IncidentKind = coalesce(tostring(IncidentData.data.kind), tostring(IncidentData.kind))\n| extend IncidentId = tostring(coalesce(IncidentData.data.id, IncidentData.id))\n| extend IncidentSummary = tostring(coalesce(IncidentData.data.summary, IncidentData.summary))\n| extend UserName = coalesce(\n    tostring(IncidentData.data.users[0].samAccountName),\n    tostring(IncidentData.data.users[0].upn),\n    tostring(IncidentData.data.users[0].displayName),\n    tostring(IncidentData.users[0].displayName)\n)\n| extend SourceHost = coalesce(\n    tostring(IncidentData.data.sources[0].displayName),\n    tostring(IncidentData.sources[0].displayName)\n)\n| extend DestinationHost = coalesce(\n    tostring(IncidentData.data.destinations[0].displayName),\n    tostring(IncidentData.destinations[0].displayName)\n)",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1098.007"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1098"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}