audit_logs

App Role Added

Oct 28, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 ·

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Account Created And Deleted Within A Close Time Frame

Oct 17, 2023 · attack.defense_evasion attack.t1078 ·

Share on:

Detects when an account was created and deleted in a short period of time.

Added Credentials to Existing Application

Oct 17, 2023 · attack.t1098.001 attack.persistence ·

Share on:

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

Added Owner To Application

Oct 17, 2023 · attack.t1552 attack.credential_access ·

Share on:

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

App Granted Microsoft Permissions

Oct 17, 2023 · attack.credential_access attack.t1528 ·

Share on:

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Application AppID Uri Configuration Changes

Oct 17, 2023 · attack.persistence attack.credential_access attack.privilege_escalation attack.t1552 attack.t1078.004 ·

Share on:

Detects when a configuration change is made to an applications AppID URI.

Application URI Configuration Changes

Oct 17, 2023 · attack.t1528 attack.t1078.004 attack.persistence attack.credential_access attack.privilege_escalation ·

Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Azure Domain Federation Settings Modified

Oct 17, 2023 · attack.initial_access attack.t1078 ·

Share on:

Identifies when an user or application modified the federation settings on the domain.

Bitlocker Key Retrieval

Oct 17, 2023 · attack.defense_evasion attack.t1078.004 ·

Share on:

Monitor and alert for Bitlocker key retrieval.

Bulk Deletion Changes To Privileged Account Permissions

Oct 17, 2023 · attack.persistence attack.t1098 ·

Share on:

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

CA Policy Removed by Non Approved Actor

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.t1548 attack.t1556 ·

Share on:

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

CA Policy Updated by Non Approved Actor

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.t1548 attack.t1556 ·

Share on:

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Changes to Device Registration Policy

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1484 ·

Share on:

Monitor and alert for changes to the device registration policy.

Changes To PIM Settings

Oct 17, 2023 · attack.privilege_escalation attack.persistence attack.t1078.004 ·

Share on:

Detects when changes are made to PIM roles

Delegated Permissions Granted For All Users

Oct 17, 2023 · attack.credential_access attack.t1528 ·

Share on:

Detects when highly privileged delegated permissions are granted on behalf of all users

End User Consent

Oct 17, 2023 · attack.credential_access attack.t1528 ·

Share on:

Detects when an end user consents to an application

End User Consent Blocked

Oct 17, 2023 · attack.credential_access attack.t1528 ·

Share on:

Detects when end user consent is blocked due to risk-based consent.

Guest User Invited By Non Approved Inviters

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.t1078.004 ·

Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Guest Users Invited To Tenant By Non Approved Inviters

Oct 17, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detects guest users being invited to tenant by non-approved inviters

New CA Policy by Non-approved Actor

Oct 17, 2023 · attack.defense_evasion attack.t1548 ·

Share on:

Monitor and alert on conditional access changes.

Password Reset By User Account

Oct 17, 2023 · attack.persistence attack.credential_access attack.t1078.004 ·

Share on:

Detect when a user has reset their password in Azure AD

PIM Alert Setting Changes To Disabled

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1078 ·

Share on:

Detects when PIM alerts are set to disabled.

PIM Approvals And Deny Elevation

Oct 17, 2023 · attack.privilege_escalation attack.t1078.004 ·

Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Privileged Account Creation

Oct 17, 2023 · attack.persistence attack.privilege_escalation attack.t1078.004 ·

Share on:

Detects when a new admin is created.

Temporary Access Pass Added To An Account

Oct 17, 2023 · attack.persistence attack.t1078.004 ·

Share on:

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

User Added To Group With CA Policy Modification Access

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.t1548 attack.t1556 ·

Share on:

Monitor and alert on group membership additions of groups that have CA policy modification access

User Added To Privilege Role

Oct 17, 2023 · attack.privilege_escalation attack.defense_evasion attack.t1078.004 ·

Share on:

Detects when a user is added to a privileged role.

User Removed From Group With CA Policy Modification Access

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.t1548 attack.t1556 ·

Share on:

Monitor and alert on group membership removal of groups that have CA policy modification access

User State Changed From Guest To Member

Oct 17, 2023 · attack.privilege_escalation attack.initial_access attack.t1078.004 ·

Share on:

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Users Added to Global or Device Admin Roles

Oct 17, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1078.004 ·

Share on:

Monitor and alert for users added to device admin roles.

App Granted Privileged Delegated Or App Permissions

Oct 12, 2023 · attack.persistence attack.privilege_escalation attack.t1098.003 ·

Share on:

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

Azure Subscription Permission Elevation Via AuditLogs

Oct 12, 2023 · attack.initial_access attack.t1078 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Change to Authentication Method

Oct 12, 2023 · attack.credential_access attack.t1556 attack.persistence attack.defense_evasion attack.t1098 ·

Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.