administrators may legitimately assign the privileged authentication administrator role as part of administrative tasks. filter as needed.

Techniques

T1003.002

Sample rules

Azure AD Privileged Authentication Administrator Role Assigned

source: splunk
technicques:
- T1003.002

Description

The following analytic identifies the assignment of the Privileged Authentication Administrato role to an Azure AD user. Users in this role can set or reset authentication methods for any user in Azure Active Directory, including privileged roles like Global Administrators. Users with this role can change credentials for people who may have access to sensitive or private information or critical configuration inside and outside of Azure Active Directory. Changing the credentials of a user may mean the ability to assume that users identity and permissions. Red teams and adversaries alike may abuse this role to escalate their privileges.

Detection logic

 `azure_monitor_aad`  "operationName"="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" 
| rename properties.* as * 
| rename initiatedBy.user.userPrincipalName as initiatedBy 
| stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by initiatedBy, result, operationName 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `azure_ad_privileged_authentication_administrator_role_assigned_filter`