Azure AD member assigned built-in Administrator role
Set up the azure integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect an Azure Active Directory (Azure AD) member being added to a built-in Administrative role.
Strategy
Monitor Azure AD Audit logs for the following operations:
@evt.name:"Add member to role"@properties.targetResources.modifiedProperties.newValue:*Administrator*
Azure AD uses roles to assign privileges to users. There are over 80 roles available, the list below details some of the highest privileged roles that adversaries could target:
This whitepaper from Mandiant describes the abuse of Azure AD privileged roles.
The field @usr.id is the user that actioned the change, and the field @properties.targetResources.userPrincipalName is the user being assigned the administrative privileges.
Triage and response
- Determine if
{{@usr.id}} should have made a {{@evt.name}} API call. - If the API call was not made by the user:
- Rotate user credentials.
- Determine what other API calls were made by the user.
- Begin your organization’s incident response (IR) process and investigate.
- If the API call was made legitimately by the user:
- Determine if
{{@usr.id}} was authorized to make the change. - Follow Microsoft’s best practices where possible to ensure the user was assigned the correct level of privileges for their function.
Changelog
- 19 December 2023 - Updated group by values to include
@properties.targetResources.userPrincipalName
