Users Added to Global or Device Admin Roles

Title: Users Added to Global or Device Admin Roles
Status: test
Description:Monitor and alert for users added to device admin roles.
References:
  -https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-administrator-roles
Author: Michael Epping, '@mepples21'
Date: 2022-06-28
modified:None
Tags:

• -'attack.persistence'
• -'attack.initial-access'
• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1078.004'

Logsource:

• product: azure
• service: auditlogs

Detection:
  selection:
    Category: 'RoleManagement'
    OperationName|contains|all:
      -'Add'
      -'member to role'

    TargetResources|contains:
      -'7698a772-787b-4ac8-901f-60d6b08affd2'
      -'62e90394-69f5-4237-9190-012177145e10'

  condition:selection
Falsepositives:
  -Unknown
Level: high