Additional Cloud Roles

// T1098.003 - Additional Cloud Roles Detection
// Covers Azure AD / Entra ID, Azure RBAC, and Office 365 role assignments
let HighPrivilegeRoles = dynamic([
  "Global Administrator", "Company Administrator",
  "Privileged Role Administrator", "Security Administrator",
  "Exchange Administrator", "SharePoint Administrator",
  "Hybrid Identity Administrator", "Application Administrator",
  "Cloud Application Administrator", "Authentication Administrator",
  "User Access Administrator", "Owner", "Contributor",
  "Privileged Authentication Administrator"
]);
let SensitiveOperations = dynamic([
  "Add member to role",
  "Add eligible member to role",
  "Add member to role in PIM requested",
  "Add member to role completed (PIM activation)",
  "Assign directory role to user",
  "Microsoft.Authorization/roleAssignments/write",
  "Microsoft.Authorization/elevateAccess/action"
]);
union
(
  // Azure AD / Entra ID role assignments via AuditLogs
  AuditLogs
  | where TimeGenerated > ago(24h)
  | where OperationName has_any (SensitiveOperations)
  | extend TargetUser = tostring(TargetResources[0].userPrincipalName)
  | extend TargetObjectId = tostring(TargetResources[0].id)
  | extend RoleName = tostring(TargetResources[0].modifiedProperties[0].newValue)
  | extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName)
  | extend InitiatedByApp = tostring(InitiatedBy.app.displayName)
  | extend InitiatedByIPAddress = tostring(InitiatedBy.user.ipAddress)
  | extend IsHighPrivilege = RoleName has_any (HighPrivilegeRoles)
  | project
      TimeGenerated,
      OperationName,
      TargetUser,
      TargetObjectId,
      RoleName,
      InitiatedByUser,
      InitiatedByApp,
      InitiatedByIPAddress,
      IsHighPrivilege,
      Result,
      CorrelationId,
      Category,
      Source = "AuditLogs"
),
(
  // Azure Activity Log - RBAC role assignments at subscription/resource level
  AzureActivity
  | where TimeGenerated > ago(24h)
  | where OperationNameValue in~ (
      "Microsoft.Authorization/roleAssignments/write",
      "Microsoft.Authorization/elevateAccess/action",
      "Microsoft.Authorization/roleDefinitions/write"
  )
  | where ActivityStatusValue == "Success"
  | extend InitiatedByUser = tostring(Caller)
  | extend TargetResource = ResourceId
  | extend SubscriptionId = tostring(SubscriptionId)
  | project
      TimeGenerated,
      OperationNameValue,
      InitiatedByUser,
      TargetResource,
      SubscriptionId,
      ResourceGroup,
      CallerIpAddress,
      ActivityStatusValue,
      Source = "AzureActivity"
)
| sort by TimeGenerated desc

index=azure_audit OR index=o365 OR index=azure_activity
(
  sourcetype="azure:aad:audit"
  OR sourcetype="o365:management:activity"
  OR sourcetype="azure:activity"
)
| eval operation=coalesce('Operation', 'operationName', 'OperationName')
| eval initiated_by=coalesce('UserId', 'InitiatedBy.user.userPrincipalName', 'Caller', 'Actor{}.ID')
| eval target_user=coalesce('ObjectId', 'TargetResources{}.userPrincipalName', 'Target{}.ID')
| eval role_assigned=coalesce('ModifiedProperties{}.NewValue', 'TargetResources{}.modifiedProperties{}.newValue', 'role')
| eval src_ip=coalesce('ClientIP', 'InitiatedBy.user.ipAddress', 'callerIpAddress')
| eval result_status=coalesce('ResultStatus', 'resultDescription', 'ActivityStatus')
(
  operation IN (
    "Add member to role.",
    "Add eligible member to role.",
    "Add member to role in PIM requested.",
    "Add member to role completed (PIM activation).",
    "Assign directory role to user",
    "Microsoft.Authorization/roleAssignments/write",
    "Microsoft.Authorization/elevateAccess/action",
    "Microsoft.Authorization/roleDefinitions/write"
  )
  OR (operation LIKE "%role%" AND (operation LIKE "%add%" OR operation LIKE "%assign%" OR operation LIKE "%write%"))
)
| eval is_high_privilege=if(
    match(lower(role_assigned), "global administrator|company administrator|privileged role administrator|security administrator|exchange administrator|sharepoint administrator|user access administrator|owner|privileged authentication administrator|hybrid identity administrator|application administrator"),
    1, 0
  )
| eval is_success=if(lower(result_status) IN ("success", "succeeded", ""), 1, 0)
| where is_success=1
| table _time, operation, initiated_by, target_user, role_assigned, src_ip, is_high_privilege, result_status, index, sourcetype
| sort - _time
| sort - is_high_privilege

any where event.dataset in ("azure.auditlogs", "o365.audit", "azure.activitylogs") and
  event.outcome == "success" and
  (
    event.action in~ (
      "add member to role.",
      "add eligible member to role.",
      "add member to role in pim requested.",
      "add member to role completed (pim activation).",
      "assign directory role to user",
      "microsoft.authorization/roleassignments/write",
      "microsoft.authorization/elevateaccess/action",
      "microsoft.authorization/roledefinitions/write"
    )
    or (
      event.action like~ "*role*"
      and (event.action like~ "*add*" or event.action like~ "*assign*" or event.action like~ "*write*")
    )
  )

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "Event Time",
  LOGSOURCENAME(logsourceid) AS "Log Source",
  LOGSOURCETYPENAME(devicetype) AS "Log Source Type",
  username AS "Initiated By",
  QIDNAME(qid) AS "Event Name",
  sourceip AS "Source IP",
  magnitude
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN (
    'Microsoft Azure Active Directory',
    'Microsoft Office 365',
    'Microsoft Azure'
  )
  AND (
    LOWER(QIDNAME(qid)) LIKE '%add member to role%'
    OR LOWER(QIDNAME(qid)) LIKE '%role assignment%'
    OR LOWER(QIDNAME(qid)) LIKE '%elevate access%'
    OR LOWER(QIDNAME(qid)) LIKE '%assign directory role%'
    OR LOWER(UTF8(payload)) LIKE '%roleassignments/write%'
    OR LOWER(UTF8(payload)) LIKE '%elevateaccess/action%'
    OR LOWER(UTF8(payload)) LIKE '%roledefinitions/write%'
  )
  AND devicetime > NOW() - 86400000
ORDER BY magnitude DESC, devicetime DESC

(_sourceCategory=azure/audit OR _sourceCategory=azure/auditlogs OR _sourceCategory=o365/management/activity OR _sourceCategory=azure/activity)
| json field=_raw "operationName" as az_operation nodrop
| json field=_raw "Operation" as o365_operation nodrop
| json field=_raw "properties.initiatedBy.user.userPrincipalName" as az_initiated_by nodrop
| json field=_raw "UserId" as o365_initiated_by nodrop
| json field=_raw "caller" as az_rbac_caller nodrop
| json field=_raw "properties.targetResources[0].userPrincipalName" as target_user nodrop
| json field=_raw "Target[0].ID" as o365_target nodrop
| json field=_raw "properties.targetResources[0].modifiedProperties[0].newValue" as role_assigned nodrop
| json field=_raw "properties.initiatedBy.user.ipAddress" as az_src_ip nodrop
| json field=_raw "callerIpAddress" as rbac_src_ip nodrop
| json field=_raw "ClientIP" as o365_src_ip nodrop
| json field=_raw "resultType" as az_result nodrop
| json field=_raw "ResultStatus" as o365_result nodrop
| eval operation = if(!isNull(az_operation) AND az_operation != "", az_operation, if(!isNull(o365_operation), o365_operation, ""))
| eval initiated_by = if(!isNull(az_initiated_by) AND az_initiated_by != "", az_initiated_by, if(!isNull(az_rbac_caller) AND az_rbac_caller != "", az_rbac_caller, o365_initiated_by))
| eval target = if(!isNull(target_user) AND target_user != "", target_user, o365_target)
| eval source_ip = if(!isNull(az_src_ip) AND az_src_ip != "", az_src_ip, if(!isNull(rbac_src_ip) AND rbac_src_ip != "", rbac_src_ip, o365_src_ip))
| eval result = if(!isNull(az_result), az_result, o365_result)
| where operation in (
    "Add member to role.",
    "Add eligible member to role.",
    "Add member to role in PIM requested.",
    "Add member to role completed (PIM activation).",
    "Assign directory role to user",
    "Microsoft.Authorization/roleAssignments/write",
    "Microsoft.Authorization/elevateAccess/action",
    "Microsoft.Authorization/roleDefinitions/write"
  )
  OR (toLowerCase(operation) matches "*role*" AND (toLowerCase(operation) matches "*add*" OR toLowerCase(operation) matches "*assign*"))
| where isNull(result) OR result matches "*success*" OR result matches "*succeeded*" OR result = ""
| eval is_high_privilege = if(
    toLowerCase(role_assigned) matches "*global administrator*"
    OR toLowerCase(role_assigned) matches "*privileged role administrator*"
    OR toLowerCase(role_assigned) matches "*security administrator*"
    OR toLowerCase(role_assigned) matches "*exchange administrator*"
    OR toLowerCase(role_assigned) matches "*sharepoint administrator*"
    OR toLowerCase(role_assigned) matches "*user access administrator*"
    OR toLowerCase(role_assigned) matches "*privileged authentication administrator*"
    OR toLowerCase(role_assigned) matches "*hybrid identity administrator*"
    OR toLowerCase(role_assigned) matches "*application administrator*"
    OR toLowerCase(role_assigned) = "owner",
    "true", "false"
  )
| fields _messageTime, operation, initiated_by, target, role_assigned, source_ip, is_high_privilege, result
| sort by _messageTime desc
| sort by is_high_privilege desc

rule t1098_003_additional_cloud_roles {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects assignment of privileged cloud roles in Azure AD, Entra ID, Azure RBAC, or Office 365. Covers direct role assignments, PIM activations, and RBAC write operations consistent with T1098.003 adversary persistence via cloud role manipulation."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1098.003"
    reference = "https://attack.mitre.org/techniques/T1098/003/"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"

  events:
    $e.metadata.vendor_name = "Microsoft"
    $e.metadata.event_type = "USER_RESOURCE_UPDATE_PERMISSIONS"
    (
      re.regex($e.metadata.product_event_type,
        `(?i)add member to role|add eligible member to role|assign directory role|roleAssignments/write|elevateAccess/action|roledefinitions/write`
      ) or
      re.regex($e.target.resource.attribute.roles.name,
        `(?i)global administrator|company administrator|privileged role administrator|security administrator|exchange administrator|sharepoint administrator|user access administrator|privileged authentication administrator|hybrid identity administrator|application administrator|cloud application administrator|authentication administrator`
      )
    )

  condition:
    $e
}

// CrowdStrike LogScale — Azure AD / O365 Cloud Role Assignment Detection (T1098.003)
// Requires Azure audit and O365 management activity ingested via Falcon LogScale Data Connector or equivalent
// Adjust tag/repository filters to match your ingestion configuration
operation := coalesce(operationName, Operation, OperationName, "")
| initiated_by := coalesce(initiatedByUserPrincipalName, UserId, caller, ActorID, "")
| target_user := coalesce(targetUserPrincipalName, TargetObjectID, ObjectId, "")
| role_assigned := coalesce(newRoleValue, roleDisplayName, ModifiedProperties_NewValue, "")
| source_ip := coalesce(initiatedByIPAddress, callerIpAddress, ClientIP, "")
| result := coalesce(resultType, ResultStatus, ActivityStatus, "")
| operation = /(?i)(add member to role|add eligible member|roleAssignments\/write|elevateAccess|assign directory role|roledefinitions\/write)/
| test(result = /(?i)(^success|^succeeded|^$)/)
| is_high_privilege := if(
    test(role_assigned = /(?i)(global administrator|company administrator|privileged role administrator|security administrator|exchange administrator|sharepoint administrator|user access administrator|privileged authentication administrator|hybrid identity administrator|application administrator|cloud application administrator|owner|contributor)/),
    "true",
    "false"
  )
| table([_time, operation, initiated_by, target_user, role_assigned, source_ip, is_high_privilege, result])
| sort(by=_time, order=desc)
| sort(by=is_high_privilege, order=desc)