Azure AD detection User added to group vs User added to role

[ceesmandjes]

Hi,

I want to create two detection rules in Sentinel using Azure AD as source:

* User added to Group

* User added to Role

In Sentinel I see there is a template named "User added to Azure Active Directory Privileged Groups" available. However,  this detection rules seems to trigger on ROLES not GROUPS:

AuditLogs

| where OperationName in~ (["Add member to role","Add member to role in PIM requested (permanent)"])

Since the name of this detection rule contains Group, I am quite surprised that it looks at the operations that are related to roles. Why is that?

In the logs I can also see that there is also a Operation available for groups:

AuditLogs

| where OperationName in~ (["Add member to group"])

Why is the group operation not used for the group template? And with which Operation can I create a detection rule for groups, and with which operation can I create a detection rule for roles?

[#2]

@ceesmandjes If you look at the rule logic, you'll see that there are 2 conditions used. One for the Operation and the other for the Group Addition. So the rule in Sentinel is using a combination of these two conditions:

where OperationName in~ (OperationList)

where GroupName in~ (PrivilegedGroups)

The values in OperationList and PrivilegedGroups have also been defined.

[#3]

@AnuragSrivastava  do you know how I make a distinction between groups and roles?

[#4]

@ceesmandjes if you wish to list out the for roles & groups, then the appropriate operation names are 'Add member to role', 'Add member to group'.

You can tweak the template rule which is mentioned above by adding these to the list, something like below (Note that, below is just a few first lines from default template rule as an example)

let timeframe = 1h;
let OperationList = dynamic(["Add member to role",  "Add member to role", "Add member to group" ,"Add member to role in PIM requested (permanent)"]);
let PrivilegedGroups = dynamic(["UserAccountAdmins","PrivilegedRoleAdmins","TenantAdmins"]);
AuditLogs
| where TimeGenerated >= ago(timeframe)
| where LoggedByService =~ "Core Directory"