Rules Contributing to Microsoft Entra Changes to Privileged Account Alert

The following rules are used to identify suspicious Microsoft Entra changes to privileged account. Any one or more of these will trigger the Microsoft Entra Changes to Privileged Account Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Password Reset By User Account

Detect when a user has reset their password in Microsoft Entra ID

Rule ID

azure_34

Query

{'selection': {'Category': 'UserManagement', 'Result': 'Success', 'ActivityDisplayName|contains': 'Password reset'}, 'filter': {'initiatedBy_user_userPrincipalName': ''}, 'condition': 'selection and not filter'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,340ee172-4b67-4fb4-832f-f961bdc1f3aa

Author: YochanaHenderson, '@Yochana-H'

Tactics, Techniques, and Procedures

PERSISTENCE, T1078.004

References

N/A

Severity

50

Suppression Logic Based On

  • initiatedBy.user.id
  • initiatedBy.app.servicePrincipalId
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
experimental 2022/08/03 medium

  • If this was approved by System Administrator or confirmed user action.

Temporary Access Pass Added To An Account

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Rule ID

azure_36

Query

{'selection': {'ResultReason': 'Admin registered temporary access pass method for user', 'properties_message': 'Admin registered security info'}, 'condition': 'selection'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,fa84aaf5-8142-43cd-9ec2-78cfebf878ce

Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'

Tactics, Techniques, and Procedures

PERSISTENCE, T1078.004

References

N/A

Severity

75

Suppression Logic Based On

  • initiatedBy.user.id
  • initiatedBy.app.servicePrincipalId
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
experimental 2022/08/10 high

  • Administrator adding a legitimate temporary access pass

Privileged Account Creation

Detects when a new admin is created.

Rule ID

azure_37

Query

{'selection': {'Result': 'Success', 'properties_message|contains|all': ['Add user', 'Add member to role']}, 'condition': 'selection'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,f7b5b004-dece-46e4-a4a5-f6fd0e1c6947

Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton

Tactics, Techniques, and Procedures

PERSISTENCE, T1078.004

References

N/A

Severity

50

Suppression Logic Based On

  • initiatedBy.user.id
  • initiatedBy.app.servicePrincipalId
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
experimental 2022/08/11 medium

  • A legitimate new admin account being created