Name:Azure AD Global Administrator Role Assigned id:825fed20-309d-4fd1-8aaf-cd49c1bb093c version:6 date:2024-09-30 author:Gowthamaraj Rajendran, Mauricio Velazco, Splunk status:production type:TTP Description:The following analytic detects the assignment of the Azure AD Global Administrator role to a user. It leverages Azure Active Directory AuditLogs to identify when the "Add member to role" operation includes the "Global Administrator" role. This activity is significant because the Global Administrator role grants extensive access to data, resources, and settings, similar to a Domain Administrator in traditional AD environments. If confirmed malicious, this could allow an attacker to establish persistence, escalate privileges, and potentially gain control over Azure resources, posing a severe security risk. Data_source:
-Azure Active Directory Add member to role
search:`azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="\"Global Administrator\"" | rename properties.* as * | rename initiatedBy.user.userPrincipalName as initiatedBy | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_global_administrator_role_assigned_filter`
how_to_implement:You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category. known_false_positives:Administrators may legitimately assign the Global Administrator role to a user. Filter as needed. References: -https://o365blog.com/post/admin/ -https://adsecurity.org/?p=4277 -https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors -https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning -https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin -https://attack.mitre.org/techniques/T1098/003/ drilldown_searches: name:'View the detection results for - "$user$"' search:'%original_detection_search% | search user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Azure Active Directory Persistence' - 'Azure Active Directory Privilege Escalation' asset_type:Azure Active Directory confidence:90 impact:80 message:Global Administrator Role assigned for User $user$ initiated by $initiatedBy$ mitre_attack_id: - 'T1098.003' observable: name:'user' type:'User' - role: - 'Victim' name:'initiatedBy' type:'User' - role: - 'Attacker' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'user' - 'properties.targetResources{}.type' - 'properties.initiatedBy.user.userPrincipalName' - 'properties.result' risk_score:72 security_domain:threat
