LoFP / administrators may legitimately assign the global administrator role to a user. filter as needed.

Techniques

• T1098.003

Sample rules

Azure AD Global Administrator Role Assigned

• source: splunk
• technicques:
  • T1098.003

Description

The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence or escalate their privileges in an Azure AD environment.

Detection logic

`azure_monitor_aad`  operationName="Add member to role"  properties.targetResources{}.modifiedProperties{}.newValue="\"Global Administrator\"" 
| rename properties.* as * 
| rename initiatedBy.user.userPrincipalName as initiatedBy 
| stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `azure_ad_global_administrator_role_assigned_filter`