Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Azure secure score admin MFA

Back
Id9a15c3dd-f72b-49a4-bcb7-94406395661e
RulenameAzure secure score admin MFA
DescriptionThis query searches for requiring multi-factor authentication (MFA) for all administrative roles makes it harder

for attackers to access accounts. Administrative roles have higher permissions than typical users.

If any of those accounts are compromised, critical devices and data is open to attack.
SeverityHigh
TacticsImpact
TechniquesT1529
T1498
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AdminMFA.yaml
Version1.0.0
Arm template9a15c3dd-f72b-49a4-bcb7-94406395661e.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreAdminMFAV2'
name: Azure secure score admin MFA
triggerOperator: gt
status: Available
relevantTechniques:
- T1529
- T1498
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreAdminMFAV2'  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AdminMFA.yaml
description: |
  'This query searches for requiring multi-factor authentication (MFA) for all administrative roles makes it harder
   for attackers to access accounts. Administrative roles have higher permissions than typical users.
   If any of those accounts are compromised, critical devices and data is open to attack.'  
triggerThreshold: 0
id: 9a15c3dd-f72b-49a4-bcb7-94406395661e
kind: Scheduled
severity: High
version: 1.0.0
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: ControlName_s
  - identifier: AadTenantId
    columnName: TenantId
  - identifier: DisplayName
    columnName: TenantDisplayName_s
  entityType: Account
- fieldMappings:
  - identifier: DistinguishedName
    columnName: Group_s
  entityType: SecurityGroup
- fieldMappings:
  - identifier: ResourceId
    columnName: SourceSystem
  entityType: AzureResource
queryFrequency: 6h
queryPeriod: 6h
requiredDataConnectors:
- dataTypes:
  - SenservaPro_CL
  connectorId: SenservaPro
tactics:
- Impact
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9a15c3dd-f72b-49a4-bcb7-94406395661e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9a15c3dd-f72b-49a4-bcb7-94406395661e')]",
      "properties": {
        "alertRuleTemplateName": "9a15c3dd-f72b-49a4-bcb7-94406395661e",
        "customDetails": null,
        "description": "'This query searches for requiring multi-factor authentication (MFA) for all administrative roles makes it harder\n for attackers to access accounts. Administrative roles have higher permissions than typical users.\n If any of those accounts are compromised, critical devices and data is open to attack.'\n",
        "displayName": "Azure secure score admin MFA",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ControlName_s",
                "identifier": "Name"
              },
              {
                "columnName": "TenantId",
                "identifier": "AadTenantId"
              },
              {
                "columnName": "TenantDisplayName_s",
                "identifier": "DisplayName"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "Group_s",
                "identifier": "DistinguishedName"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "SourceSystem",
                "identifier": "ResourceId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/AdminMFA.yaml",
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScoreAdminMFAV2'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "severity": "High",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1498",
          "T1529"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}