Granting Of Permissions To An Account

Title: Granting Of Permissions To An Account
Status: test
Description:Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
References:
  -https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
Author: sawwinnnaung
Date: 2020-05-07
modified:2023-10-11
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098.003'

Logsource:

• product: azure
• service: activitylogs

Detection:
  keywords:
    - 'Microsoft.Authorization/roleAssignments/write'
  condition:keywords
Falsepositives:
  -Valid change
Level: medium