{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "workspace": { "type": "String" } }, "resources": [ { "apiVersion": "2024-01-01-preview", "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/aceee46e-8fb3-42d9-967a-aac637bcefd4')]", "kind": "Scheduled", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/aceee46e-8fb3-42d9-967a-aac637bcefd4')]", "properties": { "alertRuleTemplateName": "aceee46e-8fb3-42d9-967a-aac637bcefd4", "customDetails": null, "description": "Detects denied privilege elevation requests in Microsoft Entra ID. Review the requester and the target workflow for possible abuse or misconfiguration.\n", "displayName": "[Entra ID] Privilege Elevation Request Denied", "enabled": true, "entityMappings": [ { "entityType": "Account", "fieldMappings": [ { "columnName": "Source_Identity_FullName", "identifier": "FullName" } ] }, { "entityType": "Account", "fieldMappings": [ { "columnName": "Target_Identity_FullName", "identifier": "FullName" } ] }, { "entityType": "IP", "fieldMappings": [ { "columnName": "Source_Network_IPAddress", "identifier": "Address" } ] } ], "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Privilege%20Elevation%20Request%20Denied.yaml", "query": "AuditLogs\n| where ActivityDisplayName =~ 'Add member to role request denied (PIM activation)'\n| mv-apply ResourceItem = TargetResources on\n (\n where ResourceItem.type =~ \"Role\"\n | extend Role = trim(@'\"', tostring(ResourceItem.displayName))\n )\n| mv-apply ResourceItem = TargetResources on\n (\n where ResourceItem.type =~ \"User\"\n | extend TargetUserPrincipalName = trim(@'\"', tostring(ResourceItem.userPrincipalName))\n )\n//| where ResultReason != \"RoleAssignmentExists\"\n| where isnotempty(InitiatedBy.user)\n| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)\n| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)\n| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\n| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)\n| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))\n| extend\n TargetName = tostring(split(TargetUserPrincipalName, '@', 0)[0]),\n TargetUPNSuffix = tostring(split(TargetUserPrincipalName, '@', 1)[0])\n| extend\n InitiatedByName = tostring(split(InitiatingUserPrincipalName, '@', 0)[0]),\n InitiatedByUPNSuffix = tostring(split(InitiatingUserPrincipalName, '@', 1)[0])\n| project-reorder\n TimeGenerated,\n TargetUserPrincipalName,\n Role,\n OperationName,\n Result,\n ResultDescription\n| extend\n InitiatingUser = tostring(InitiatedBy.user.userPrincipalName)\n| extend Source_Network_IPLocation = \"\"\n| project\n Alert_Category_en = \"Entra ID\",\n Alert_SubCategory_en = \"Anomaly Identity Privilege Modification\",\n Alert_Name_en = \"Privilege Elevation Request Denied\",\n Alert_Description_en=strcat(\n \"At Taiwan time: \",\n format_datetime(datetime_utc_to_local(TimeGenerated, \"Asia/Taipei\"), \"yyyy-MM-dd HH:mm:ss\"),\n \" in Entra ID: \",\n \"\",\n \", detected PIM role activation failure: target user: \",\n iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, \"\"),\n \", target role: \",\n iff(isnotempty(Role), Role, \"\"),\n \", initiator: \",\n iff(isnotempty(InitiatingUser), InitiatingUser, \"\"),\n \", source IP: \",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"\"),\n \", result: \",\n iff(isnotempty(Result), Result, \"\"),\n \" (reason: \",\n iff(isnotempty(ResultDescription), ResultDescription, \"\"),\n \").\"\n ),\n Alert_TriageStep_en=strcat(\n \"1. Confirm the activation target: user: \",\n iff(isnotempty(TargetUserPrincipalName), TargetUserPrincipalName, \"\"),\n \", role: \",\n iff(isnotempty(Role), Role, \"\"),\n \" is an expected PIM activation request.\",\n \"2. Check the failure reason: \",\n iff(isnotempty(ResultDescription), ResultDescription, \"\"),\n \", and determine whether it was caused by MFA/Conditional Access/approval process/insufficient permissions.\",\n \"3. Check source risk: \",\n iff(isnotempty(InitiatingUser), InitiatingUser, \"\"),\n \", IP:\",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"\"),\n \" to determine whether it is a company named location/VPN/jump server, abnormal location, or uncommon source.\"\n ),\n Alert_Containment_en=strcat(\n \"1. If determined to be a suspicious attempt, immediately restrict initiator: \",\n iff(isnotempty(InitiatingUser), InitiatingUser, \"\"),\n \" 's PIM activation permissions or suspend the scope of high-risk roles that can be activated. \",\n \"2. Immediately revoke suspicious sign-in tokens/sessions and force re-authentication (initiator: \",\n iff(isnotempty(InitiatingUser), InitiatingUser, \"\"),\n \"), and reset the password and re-register MFA if necessary. \",\n \"3. Apply stricter Conditional Access to source IP: \",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"\"),\n \" (named locations/compliant devices/MFA only), or block it first to stop repeated attempts. \",\n \"4. If the failure was caused by the approval process/policy, suspend activation requests outside the change window and notify administrators for confirmation.\"\n ),\n Alert_Remediation_en=strcat(\n \"1. Strengthen PIM governance: require approval and justification for high-privilege role activation, and limit the scope of activatable roles (least privilege/separation of duties). \",\n \"2. Strengthen Conditional Access: enforce MFA, compliant devices, and named locations for PIM/management-plane operations, and directly block abnormal IPs/locations. \",\n \"3. Establish alerts and automated response: set thresholds and automated SOAR for PIM activation failures (notification, IP blocking, account suspension). \"\n ),\n Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),\n Alert_Time_UTC0 = TimeGenerated,\n Event_Action = OperationName,\n Event_Status = Result,\n Event_Description = ResultDescription,\n Source_Identity_FullName = InitiatingUser,\n Source_Identity_ID = InitiatingAadUserId,\n // Source_Identity_Name = InitiatingName,\n Source_Identity_Type = iff(isnotempty(InitiatingUser), \"User\", \"Service\"),\n Source_Network_IPAddress = InitiatingIpAddress,\n Target_Identity_FullName = TargetUserPrincipalName,\n Source_Resource_ID = InitiatingAppServicePrincipalId,\n Source_Resource_Name = InitiatingAppName,\n //Target_Identity_Name = InvitedUserName,\n Target_Identity_Type = \"User\",\n Target_Identity_DomainType = iff(TargetUserPrincipalName contains \"EXT\", 'External', 'Internal'),\n Target_Resource_ID = \"\",\n Target_Resource_Name = \"Microsoft Entra ID\",\n Target_Resource_Type = \"Microsoft Entra ID\"\n", "queryFrequency": "PT2H", "queryPeriod": "PT2H", "severity": "High", "status": "Available", "subTechniques": [ "T1078.004" ], "suppressionDuration": "PT1H", "suppressionEnabled": false, "tactics": [ "DefenseEvasion", "InitialAccess", "Persistence", "PrivilegeEscalation" ], "techniques": [ "T1078" ], "templateVersion": "1.0.0", "triggerOperator": "GreaterThan", "triggerThreshold": 0 }, "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules" } ] }