{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "workspace": { "type": "String" } }, "resources": [ { "apiVersion": "2024-01-01-preview", "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b64ac0e2-a241-4b9a-ad3e-ae572630b295')]", "kind": "Scheduled", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b64ac0e2-a241-4b9a-ad3e-ae572630b295')]", "properties": { "alertRuleTemplateName": "b64ac0e2-a241-4b9a-ad3e-ae572630b295", "customDetails": null, "description": "Detects when a privileged role is assigned to a new user account. This can indicate unauthorized elevation of privileges.\n", "displayName": "[Entra ID] Privileged Role Assigned to a New User", "enabled": true, "entityMappings": [ { "entityType": "Account", "fieldMappings": [ { "columnName": "Source_Identity_FullName", "identifier": "FullName" } ] }, { "entityType": "Account", "fieldMappings": [ { "columnName": "Target_Identity_FullName", "identifier": "FullName" } ] }, { "entityType": "IP", "fieldMappings": [ { "columnName": "Source_Network_IPAddress", "identifier": "Address" } ] } ], "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Privileged%20Role%20Assigned%20to%20a%20New%20User.yaml", "query": "// Define the start and end times based on input values\nlet starttime = now() - 1h;\nlet endtime = now();\n// Set a lookback period of 14 days\nlet lookback = starttime - 14d;\n// Define a reusable function to query audit logs\nlet awsFunc = (start: datetime, end: datetime) {\n AuditLogs\n | where TimeGenerated between (start .. end)\n | where Category =~ \"RoleManagement\"\n | where AADOperationType in (\"Assign\", \"AssignEligibleRole\")\n | where ActivityDisplayName has_any (\"Add eligible member to role\", \"Add member to role\")\n | mv-apply TargetResource = TargetResources on\n (\n where TargetResource.type in~ (\"User\", \"ServicePrincipal\")\n | extend\n Target = iff(TargetResource.type =~ \"ServicePrincipal\", tostring(TargetResource.displayName), tostring(TargetResource.userPrincipalName)),\n props = TargetResource.modifiedProperties\n )\n | mv-apply Property = props on\n (\n where Property.displayName =~ \"Role.DisplayName\"\n | extend RoleName = trim('\"', tostring(Property.newValue))\n )\n | where RoleName contains \"Admin\" and Result == \"success\"\n};\n// Query for audit events in the current day\nlet EventInfo_CurrentDay = awsFunc(starttime, endtime);\n// Query for audit events in the historical period (lookback)\nlet EventInfo_historical = awsFunc(lookback, starttime);\n// Find unseen events by performing a left anti-join\nlet EventInfo_Unseen = (EventInfo_CurrentDay\n | join kind=leftanti(EventInfo_historical) on Target, RoleName, OperationName\n );\n// Extend and clean up the results\nEventInfo_Unseen\n| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)\n| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)\n| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\n| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)\n| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))\n| extend Initiator = iif(isnotempty(InitiatingAppName), InitiatingAppName, InitiatingUserPrincipalName)\n// You can uncomment the lines below to filter out PIM activations\n| where Initiator != \"MS-PIM\"\n//| summarize StartTime=min(TimeGenerated), EndTime=min(TimeGenerated) by OperationName, RoleName, Target, Initiator, Result\n// Project specific columns and split them for further analysis\n| project\n TimeGenerated,\n OperationName,\n RoleName,\n Target,\n Initiator,\n InitiatingUserPrincipalName,\n InitiatingAadUserId,\n InitiatingAppName,\n InitiatingAppServicePrincipalId,\n InitiatingIpAddress,\n Result\n| extend\n TargetName = tostring(split(Target, '@', 0)[0]),\n TargetUPNSuffix = tostring(split(Target, '@', 1)[0]),\n InitiatorName = tostring(split(InitiatingUserPrincipalName, '@', 0)[0]),\n InitiatorUPNSuffix = tostring(split(InitiatingUserPrincipalName, '@', 1)[0])\n| extend\n Source_Network_IPLocation = \"\",\n ActivityType=OperationName\n| project\n Alert_Category_en = \"Entra ID\",\n Alert_SubCategory_en = \"Anomaly Identity Privilege Modification\",\n Alert_Name_en = \"Privileged Role Assigned to a New User\",\n Alert_Description_en = strcat(\n \"At Taiwan time: \",\n format_datetime(datetime_utc_to_local(TimeGenerated, \"Asia/Taipei\"), \"yyyy-MM-dd HH:mm:ss\"),\n \"in the Microsoft Entra ID tenant\",\n \"operator: \",\n iff(isnotempty(Initiator), Initiator, InitiatingAppName),\n \", from IP: \",\n InitiatingIpAddress,\n \", assigned privileged role \",\n tostring(RoleName),\n \" to \",\n iff(isnotempty(Target), Target, \"\"),\n \". This permission change behavior has not appeared for this user recently (within 14 days).\"\n ),\n Alert_TriageStep_en = strcat(\n \"1. Confirm whether the privileged role assignment was performed through an Entra ID PIM-approved change process.\",\n \"2. Confirm with the operator: \",\n iff(isnotempty(Initiator), Initiator, \"\"),\n \" whether this was performed by the account owner.\",\n \"3. Check whether the source IP and geolocation are abnormal or not a company public IP.\"\n ),\n Alert_Containment_en = strcat(\n \"1. If determined to be an unauthorized role assignment, immediately revoke the target \",\n iff(isnotempty(Target), Target, \"\"),\n \" 's privileged role (\",\n tostring(RoleName),\n \"), and restore the state to before the change.\",\n \"2. Immediately restrict the source identity (user or application) that performed the role assignment, revoke sign-in tokens, and force password and MFA reset if necessary. \",\n \"3. If the source is an application (\",\n iff(isnotempty(InitiatingAppName), InitiatingAppName, \"\"),\n \"), immediately disable the Service Principal and revoke high-privilege API consent and credentials/secrets. \"\n ),\n Alert_Remediation_en = strcat(\n \"1. Allow privileged role access only through Entra ID PIM.\",\n \"2. Enforce Conditional Access and MFA for role management and PIM operations, allowing them only from managed devices and named locations.\",\n \"3. Establish real-time alerts and automated response (SOAR) for privileged role changes to detect abnormal role assignments immediately. \"\n ),\n Alert_Time_TW = datetime_utc_to_local(TimeGenerated, \"Asia/Taipei\"),\n Alert_Time_UTC0 = TimeGenerated,\n Event_Action = ActivityType,\n Event_Status = Result,\n //Event_Description = ActivityDisplayName,\n Source_Identity_FullName = iff(isnotempty(Initiator), Initiator, InitiatingAppName),\n //Source_Identity_ID = ActorID,\n Source_Identity_Type = iff(isnotempty(Initiator), \"User\", \"Service\"),\n Source_Network_IPAddress = InitiatingIpAddress,\n Source_Network_IPLocation = Source_Network_IPLocation,\n //Source_Resource_Name = InitiatingAppName,\n Target_Identity_FullName = Target,\n Target_Identity_DomainType = iff(Target contains \"EXT\", 'External', 'Internal'),\n Target_Identity_Type = \"User\",\n Target_Resource_ID = \"\",\n Target_Resource_Type = \"Entra ID\"\n", "queryFrequency": "PT1H", "queryPeriod": "P14D", "severity": "High", "status": "Available", "subTechniques": [ "T1078.004" ], "suppressionDuration": "PT1H", "suppressionEnabled": false, "tactics": [ "DefenseEvasion", "InitialAccess", "Persistence", "PrivilegeEscalation" ], "techniques": [ "T1078" ], "templateVersion": "1.0.0", "triggerOperator": "GreaterThan", "triggerThreshold": 0 }, "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules" } ] }