Identity assigned an Azure AD Administrator Role

Cortex XDR Analytics Alert Reference by data source

Product: Cortex XDR
Last date published: 2024-12-03
Category: Analytics Alert Reference
Order: data source

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: AzureAD Audit Log
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation: Additional Cloud Roles (T1098.003)
Severity	Informational

Description

An identity was assigned an Azure AD Administrator role.

Attacker's Goals

An attacker may add additional roles or permissions to an attacker controlled cloud account to maintain persistent access to a tenant.

Investigative actions

Check if the added account is new to the organization.
Check whether the account that added the account to the role is permitted to perform such actions.
Check what can be affected by the assigned role
Follow further actions done by the account that was added to the role.

Variations

Identity assigned an Azure AD Administrator Role by an Application

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation: Additional Cloud Roles (T1098.003)
Severity	Medium

Description

An identity was assigned an Azure AD Administrator role by an application.

Attacker's Goals

An attacker may add additional roles or permissions to an attacker controlled cloud account to maintain persistent access to a tenant.

Investigative actions

Check if the added account is new to the organization.
Check whether the account that added the account to the role is permitted to perform such actions.
Check what can be affected by the assigned role
Follow further actions done by the account that was added to the role.

Suspicious Azure AD Administrator Role assignment

Synopsis

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation: Additional Cloud Roles (T1098.003)
Severity	Low

Description

An identity was assigned an Azure AD Administrator role.

Attacker's Goals

An attacker may add additional roles or permissions to an attacker controlled cloud account to maintain persistent access to a tenant.

Investigative actions

Check if the added account is new to the organization.
Check whether the account that added the account to the role is permitted to perform such actions.
Check what can be affected by the assigned role
Follow further actions done by the account that was added to the role.