Sagan medium stable other

[AZURE-EVENTHUB-AD] Security Operator Created

[AZURE-EVENTHUB-AD] Security Operator Created

View Source

Detection Logic

alert any any any -> any any (msg: "[AZURE-EVENTHUB-AD] Security Operator Created"; program: azureEventHub; json_content: ".operationName", "Add member to role"; content: "Security Operator"; classtype: suspicious-traffic; reference: url, https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference; sid: 5014649; metadata: created_on 2024_05_09, mitre_technique_id T1136, updated_on 2024_06_13; rev:3;)

Field Validations

Loading…

Comments (0)

Loading comments...