Granting Of Permissions To An Account

calendar Oct 12, 2023 · attack.persistence attack.t1098.003  ·
Share on: linkedin copy

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Sigma rule (View on GitHub)

 1title: Granting Of Permissions To An Account
 2id: a622fcd2-4b5a-436a-b8a2-a4171161833c
 3status: test
 4description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
 5references:
 6    - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
 7author: sawwinnnaung
 8date: 2020/05/07
 9modified: 2023/10/11
10tags:
11    - attack.persistence
12    - attack.t1098.003
13logsource:
14    product: azure
15    service: activitylogs
16detection:
17    keywords:
18        - Microsoft.Authorization/roleAssignments/write
19    condition: keywords
20falsepositives:
21    - Valid change
22level: medium

References

Related rules

to-top