Palo Alto Prisma Cloud - IAM Group with Administrator Access Permissions

Back


Id	ac76d9c0-17a3-4aaa-a341-48f4c0b1c882
Rulename	Palo Alto Prisma Cloud - IAM Group with Administrator Access Permissions
Description	Detects IAM Groups with Administrator Access Permissions.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	PaloAltoPrismaCloud
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudIamAdminGroup.yaml
Version	1.0.1
Arm template	ac76d9c0-17a3-4aaa-a341-48f4c0b1c882.json

KQL

PaloAltoPrismaCloud
| where Reason =~ 'NEW_ALERT'
| where Status =~ 'open'
| where AlertMessage has 'IAM Groups with Administrator Access Permissions'
| extend AccountCustomEntity = UserName

YAML

queryPeriod: 1h
query: |
  PaloAltoPrismaCloud
  | where Reason =~ 'NEW_ALERT'
  | where Status =~ 'open'
  | where AlertMessage has 'IAM Groups with Administrator Access Permissions'
  | extend AccountCustomEntity = UserName  
name: Palo Alto Prisma Cloud - IAM Group with Administrator Access Permissions
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudIamAdminGroup.yaml
requiredDataConnectors:
- connectorId: PaloAltoPrismaCloud
  dataTypes:
  - PaloAltoPrismaCloud
description: |
    'Detects IAM Groups with Administrator Access Permissions.'
kind: Scheduled
version: 1.0.1
status: Available
severity: Medium
relevantTechniques:
- T1078
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: ac76d9c0-17a3-4aaa-a341-48f4c0b1c882

ARM