SlackAudit - User role changed to admin or owner

Back


Id	be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e
Rulename	SlackAudit - User role changed to admin or owner
Description	This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege escalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the primary account entity for investigation.
Severity	Low
Tactics	Persistence PrivilegeEscalation
Techniques	T1098 T1078
Required data connectors	SlackAuditAPI
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUserChangedToAdminOrOwner.yaml
Version	1.0.1
Arm template	be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e.json

KQL

SlackAudit
| where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')
| extend AccountCustomEntity = SrcUserName

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
tactics:
- Persistence
- PrivilegeEscalation
requiredDataConnectors:
- dataTypes:
  - SlackAudit_CL
  connectorId: SlackAuditAPI
alertDetailsOverride:
  alertDisplayNameFormat: Slack user role changed to {{AccountCustomEntity}}
  alertDescriptionFormat: Slack role change action {{DvcAction}} affected user {{AccountCustomEntity}}
id: be6c5fc9-2ac3-43e6-8fb0-cb139e04e43e
severity: Low
status: Available
customDetails:
  AffectedUser: AccountCustomEntity
  Action: DvcAction
query: |
  SlackAudit
  | where DvcAction in~ ('role_change_to_admin', 'role_change_to_owner')
  | extend AccountCustomEntity = SrcUserName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SlackAudit/Analytic Rules/SlackAuditUserChangedToAdminOrOwner.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.1
name: SlackAudit - User role changed to admin or owner
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1098
- T1078
description: |
  'This query detects Slack audit events where a user role is changed to admin or owner, indicating potential privilege
  escalation or persistence activity. It monitors role change actions in Slack audit logs and maps the affected user as the
  primary account entity for investigation.'  
triggerOperator: gt

ARM