Granting Of Permissions To An Account

 1title: Granting Of Permissions To An Account
 2id: a622fcd2-4b5a-436a-b8a2-a4171161833c
 3status: test
 4description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
 5references:
 6    - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
 7author: sawwinnnaung
 8date: 2020-05-07
 9modified: 2023-10-11
10tags:
11    - attack.persistence
12    - attack.t1098.003
13logsource:
14    product: azure
15    service: activitylogs
16detection:
17    keywords:
18        - Microsoft.Authorization/roleAssignments/write
19    condition: keywords
20falsepositives:
21    - Valid change
22level: medium

References

• Azure-Sentinel/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml at e534407884b1ec5371efc9f76ead282176c9e8bb · Azure/Azure-Sentinel

  

  Cloud-native SIEM for intelligent security analytics for your entire enterprise. - Azure/Azure-Sentinel

  
  Read More

Related rules

• App Granted Privileged Delegated Or App Permissions
• Github Outside Collaborator Detected
• Okta Admin Role Assigned to an User or Group
• User Added to an Administrator's Azure AD Role
• A Member Was Added to a Security-Enabled Global Group