Created NRT_PrivlegedRoleAssignedOutsidePIM.yaml

Detections/AuditLogs/NRT_PrivlegedRoleAssignedOutsidePIM.yaml

@@ -0,0 +1,31 @@
+id: 14f6da04-2f96-44ee-9210-9ccc1be6401e
+name: NRT Privileged Role Assigned Outside PIM
+description: |
+  'Identifies a privileged role being assigned to a user outside of PIM
+  Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor-1'
+severity: Low
+requiredDataConnectors:
+  - connectorId: AzureActiveDirectory
+    dataTypes:
+      - AuditLogs
+tactics:
+  - PrivilegeEscalation
+relevantTechniques:
+  - T1078.004
+query: |
+  AuditLogs
+  | where Category =~ "RoleManagement"
+  | where OperationName has "Add member to role outside of PIM"
+          or (LoggedByService == "Core Directory" and OperationName == "Add member to role" and Identity != "MS-PIM")
+  | extend AccountCustomEntity = tostring(TargetResources[0].userPrincipalName), IPCustomEntity = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
+entityMappings:
+  - entityType: Account
+    fieldMappings:
+      - identifier: FullName
+        columnName: AccountCustomEntity
+  - entityType: IP
+    fieldMappings:
+      - identifier: Address
+        columnName: IPCustomEntity
+version: 1.0.0
+kind: NRT