Delegated Permissions Granted For All Users

calendar Oct 17, 2023 · attack.credential_access attack.t1528  ·
Share on: linkedin copy

Detects when highly privileged delegated permissions are granted on behalf of all users

Sigma rule (View on GitHub)

 1title: Delegated Permissions Granted For All Users
 2id: a6355fbe-f36f-45d8-8efc-ab42465cbc52
 3status: test
 4description: Detects when highly privileged delegated permissions are granted on behalf of all users
 5references:
 6    - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions
 7author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
 8date: 2022/07/28
 9tags:
10    - attack.credential_access
11    - attack.t1528
12logsource:
13    product: azure
14    service: auditlogs
15detection:
16    selection:
17        properties.message: Add delegated permission grant
18    condition: selection
19falsepositives:
20    - When the permission is legitimately needed for the app
21level: high

References

Related rules

to-top