Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

User assigned to a default admin role

Back
Idc04ed74c-3b23-48cd-9c11-fd10cffddc64
RulenameUser assigned to a default admin role
DescriptionThe policy detects users that were assigned to one of the systems default admin roles.
SeverityHigh
TacticsInitialAccess
TechniquesT1078
Required data connectorsAuthomize
KindScheduled
Query frequency30m
Query period30m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/User_assigned_to_a_default_admin_role.yaml
Version1.0.2
Arm templatec04ed74c-3b23-48cd-9c11-fd10cffddc64.json
Deploy To Azure
Authomize_v2_CL
| where ingestion_time() >= ago(30m)
| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
| where Policy has "User assigned to a default admin role"
| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics
suppressionEnabled: false
customDetails:
  EventRecommendation: Recommendation
  AuthomizeEventID: EventID
  EventDescription: Description
  EventName: Policy
  ReferencedURL: URL
status: Available
id: c04ed74c-3b23-48cd-9c11-fd10cffddc64
alertDetailsOverride:
  alertSeverity: Severity
  alertDescriptionFormat: |
        User assigned to a default admin role. The rule detects users that were assigned to one of the systems default admin roles.
  alertTactics: Tactics
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: URL
  alertnameFormat: Alert from Authomize - User assigned to a default admin role
query: |-
  Authomize_v2_CL
  | where ingestion_time() >= ago(30m)
  | extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s
  | where Policy has "User assigned to a default admin role"
  | project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics  
suppressionDuration: 5h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/User_assigned_to_a_default_admin_role.yaml
description: The policy detects users that were assigned to one of the systems default admin roles.
name: User assigned to a default admin role
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AnyAlert
    groupByEntities: []
    groupByAlertDetails: []
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
    groupByCustomDetails: []
  createIncident: true
relevantTechniques:
- T1078
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: URL
triggerThreshold: 0
severity: High
requiredDataConnectors:
- dataTypes:
  - Authomize_v2_CL
  connectorId: Authomize
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 30m
queryPeriod: 30m
version: 1.0.2
kind: Scheduled
tactics:
- InitialAccess
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c04ed74c-3b23-48cd-9c11-fd10cffddc64')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c04ed74c-3b23-48cd-9c11-fd10cffddc64')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "User assigned to a default admin role. The rule detects users that were assigned to one of the systems default admin roles.\n",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "URL"
            }
          ],
          "alertnameFormat": "Alert from Authomize - User assigned to a default admin role",
          "alertSeverity": "Severity",
          "alertTactics": "Tactics"
        },
        "alertRuleTemplateName": "c04ed74c-3b23-48cd-9c11-fd10cffddc64",
        "customDetails": {
          "AuthomizeEventID": "EventID",
          "EventDescription": "Description",
          "EventName": "Policy",
          "EventRecommendation": "Recommendation",
          "ReferencedURL": "URL"
        },
        "description": "The policy detects users that were assigned to one of the systems default admin roles.",
        "displayName": "User assigned to a default admin role",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "URL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Authomize/Analytic Rules/User_assigned_to_a_default_admin_role.yaml",
        "query": "Authomize_v2_CL\n| where ingestion_time() >= ago(30m)\n| extend EventID = id_s, Policy = policy_name_s, Severity = severity_s,Description = description_s,Recommendation = recommendation_s,URL = url_s,Tactics = tactics_s\n| where Policy has \"User assigned to a default admin role\"\n| project  EventID, Policy, Severity, Description, Recommendation, URL, Category, Tactics",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}