SlackAudit - User role changed to admin or owner | Microsoft Sentinel Analytic Rules

Back


Id	be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e
Rulename	SlackAudit - User role changed to admin or owner
Description	This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege escalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the primary account entity for investigation.
Severity	Low
Tactics	Persistence PrivilegeEscalation
Techniques	T1098 T1078
Required data connectors	SlackAuditAPI
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic%20Rules/SlackAuditUserChangedToAdminOrOwner.yaml
Version	1.0.1
Arm template	be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e.json

KQL

SlackAudit
| where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')
| extend AccountCustomEntity = SrcUserName

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
query: |
  SlackAudit
  | where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')
  | extend AccountCustomEntity = SrcUserName
id: be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e
queryFrequency: 1h
alertDetailsOverride:
  alertDisplayNameFormat: Slack user role changed to {{AccountCustomEntity}}
  alertDescriptionFormat: Slack role change action {{DvcAction}} affected user {{AccountCustomEntity}}
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic%20Rules/SlackAuditUserChangedToAdminOrOwner.yaml
version: 1.0.1
severity: Low
relevantTechniques:
- T1098
- T1078
name: SlackAudit - User role changed to admin or owner
kind: Scheduled
tactics:
- Persistence
- PrivilegeEscalation
requiredDataConnectors:
- dataTypes:
  - SlackAudit_CL
  connectorId: SlackAuditAPI
description: |
  'This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege
  escalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the
  primary account entity for investigation.'
customDetails:
  AffectedUser: AccountCustomEntity
  Action: DvcAction
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Slack role change action {{DvcAction}} affected user {{AccountCustomEntity}}",
          "alertDisplayNameFormat": "Slack user role changed to {{AccountCustomEntity}}"
        },
        "alertRuleTemplateName": "be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e",
        "customDetails": {
          "Action": "DvcAction",
          "AffectedUser": "AccountCustomEntity"
        },
        "description": "'This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege\nescalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the\nprimary account entity for investigation.'\n",
        "displayName": "SlackAudit - User role changed to admin or owner",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic%20Rules/SlackAuditUserChangedToAdminOrOwner.yaml",
        "query": "SlackAudit\n| where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')\n| extend AccountCustomEntity = SrcUserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078",
          "T1098"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}