Forum Discussion

guidovbrakel's avatar
guidovbrakel
Brass Contributor
May 15, 2022

Self added to privliged groups

Can someone help me with an Sentinel Analytics Rule which alerts when someone adds himself to a privileged role. I found this one and I would like to modify it bit that it only triggers when someone adds him/herself in a privileged role:
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/UserAssignedPrivilegedRole.yaml 
analytics
detection
KQL
kusto

7 Replies

  • mikhailf's avatar
    mikhailf
    Steel Contributor
    May 16, 2022

    Hello guidovbrakel,

    Could you please elaborate on the question? 

    This query does trigger when someone adds him/herself to a privileged role (an Admin role).

    • guidovbrakel's avatar
      guidovbrakel
      Brass Contributor
      May 16, 2022
      Hi, I want to be alerted only when someone add himself to a PIM role, so not when someone is added to a PIM role
      • mikhailf's avatar
        mikhailf
        Steel Contributor
        May 16, 2022

        guidovbrakel 

         

        Please, try this: 

         

        AuditLogs
        | where Category =~ "RoleManagement"
        | where AADOperationType in ("ActivateRole")
        | where ActivityDisplayName has_any ("Add eligible member to role", "Add member to role")
        | extend DisplayName = TargetResources[0].displayName
        | where DisplayName contains "Admin"
        | extend InitiatorUser = parse_json(tostring(InitiatedBy.user)).userPrincipalName
        | extend TargetUser = tostring(TargetResources[2].userPrincipalName)
        | extend check = iif(InitiatorUser == TargetUser, "Success", "Fail")
        | where check == "Success"
        | summarize by bin(TimeGenerated, 1h), OperationName, tostring(DisplayName), TargetUser, tostring(InitiatorUser), Result

         

        Please, note that the query depends on your environment and there can be some changes.