Elastic high stable kql

Azure RBAC Built-In Administrator Roles Assigned

Identifies when a user is assigned a built-in administrator role in Azure RBAC (Role-Based Access Control). These roles provide significant privileges and can be abused by attackers for lateral movement, persistence, or privilege escalation. The privileged built-in administrator roles include Owner, Contributor, User Access Administrator, Azure File Sync Administrator, Reservations Administrator, and Role Based Access Control Administrator.

View Source

Detection Logic

data_stream.dataset: azure.activitylogs and
    event.action: "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE" and
    azure.activitylogs.properties.requestbody.properties.roleDefinitionId:
    (
      *18d7d88d-d35e-4fb5-a5c3-7773c20a72d9* or
      *f58310d9-a9f6-439a-9e8d-f62e7b41a168* or
      *b24988ac-6180-42a0-ab88-20f7382dd24c* or
      *8e3af657-a8ff-443c-a75c-2fe8c4bcb635* or
      *92b92042-07d9-4307-87f7-36a593fc5850* or
      *a8889054-8d42-49c9-bc1c-52486c10e7cd*
    ) and not (
        azure.activitylogs.identity.claims.appid: "7319c514-987d-4e9b-ac3d-d38c4f427f4c" and
        azure.activitylogs.identity.authorization.evidence.role: "Service Owner role" and
        azure.activitylogs.identity.authorization.evidence.principal_type: "ServicePrincipal" and
        azure.activitylogs.properties.requestbody.properties.roleDefinitionId: *b24988ac-6180-42a0-ab88-20f7382dd24c*
    )

Field Validations

Loading…

Comments (0)

Loading comments...