Modify Cloud Resource Hierarchy

let AzureHierarchyOps = AzureActivity
| where TimeGenerated > ago(1d)
| where OperationNameValue in~ (
    "MICROSOFT.SUBSCRIPTION/SUBSCRIPTIONS/WRITE",
    "MICROSOFT.SUBSCRIPTION/SUBSCRIPTIONS/DELETE",
    "MICROSOFT.MANAGEMENT/MANAGEMENTGROUPS/WRITE",
    "MICROSOFT.MANAGEMENT/MANAGEMENTGROUPS/DELETE",
    "MICROSOFT.MANAGEMENT/MANAGEMENTGROUPS/SUBSCRIPTIONS/WRITE",
    "MICROSOFT.MANAGEMENT/MANAGEMENTGROUPS/SUBSCRIPTIONS/DELETE",
    "MICROSOFT.BILLING/TRANSFERS/ACCEPT",
    "MICROSOFT.BILLING/TRANSFERS/INITIATE"
)
| extend CallerClaims = parse_json(Claims)
| extend UserPrincipalName = tostring(CallerClaims["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"])
| extend TenantId = tostring(CallerClaims["tid"])
| project
    TimeGenerated,
    Source = "AzureActivity",
    Operation = OperationNameValue,
    Status = ActivityStatus,
    CallerIpAddress,
    Caller,
    UserPrincipalName,
    SubscriptionId,
    ResourceGroup,
    ResourceId,
    TenantId;
let AzureAuditHierarchy = AuditLogs
| where TimeGenerated > ago(1d)
| where OperationName in~ (
    "Add subscription",
    "Delete subscription",
    "Update subscription",
    "Add management group",
    "Delete management group",
    "Move subscription to management group",
    "Remove subscription from management group"
)
| extend InitiatedByUser = tostring(parse_json(tostring(InitiatedBy))["user"]["userPrincipalName"])
| extend InitiatedByIP = tostring(parse_json(tostring(InitiatedBy))["user"]["ipAddress"])
| project
    TimeGenerated,
    Source = "AuditLogs",
    Operation = OperationName,
    Status = Result,
    CallerIpAddress = InitiatedByIP,
    Caller = InitiatedByUser,
    UserPrincipalName = InitiatedByUser,
    SubscriptionId = "",
    ResourceGroup = "",
    ResourceId = TargetResources,
    TenantId = TenantId;
union AzureHierarchyOps, AzureAuditHierarchy
| extend RiskScore = case(
    Operation has_any ("TRANSFERS", "Transfer"), 100,
    Operation has_any ("DELETE", "Delete"), 85,
    Operation has_any ("MANAGEMENTGROUPS/SUBSCRIPTIONS", "Remove subscription"), 80,
    Operation has_any ("SUBSCRIPTIONS/WRITE", "Add subscription"), 70,
    Operation has_any ("MANAGEMENTGROUPS/WRITE", "Add management group"), 65,
    60
)
| where RiskScore >= 65
| order by RiskScore desc, TimeGenerated desc

index=* sourcetype="aws:cloudtrail"
| search eventName IN (
    "LeaveOrganization",
    "CreateAccount",
    "MoveAccount",
    "InviteAccountToOrganization",
    "RemoveAccountFromOrganization",
    "AcceptHandshake",
    "DeclineHandshake",
    "DeleteOrganizationalUnit",
    "CreateOrganizationalUnit",
    "DeleteOrganization",
    "DetachPolicy",
    "DisablePolicyType"
)
| eval risk_score=case(
    eventName="LeaveOrganization", 100,
    eventName="RemoveAccountFromOrganization", 95,
    eventName="DeleteOrganization", 100,
    eventName="DisablePolicyType", 90,
    eventName="DetachPolicy", 80,
    eventName="CreateAccount", 70,
    eventName="DeleteOrganizationalUnit", 75,
    eventName="AcceptHandshake", 60,
    eventName="MoveAccount", 55,
    true(), 50
)
| eval actor=coalesce('userIdentity.arn', 'userIdentity.userName', 'userIdentity.principalId', "unknown")
| eval assumed_role=if(userIdentity.type="AssumedRole", "true", "false")
| eval error_present=if(isnotnull(errorCode), errorCode." - ".errorMessage, "none")
| eval target_account=coalesce('requestParameters.accountId', 'requestParameters.targetId', "N/A")
| where risk_score >= 55
| table _time, eventName, actor, assumed_role, sourceIPAddress, awsRegion, target_account, risk_score, error_present, userAgent
| sort -risk_score, -_time

any where event.dataset : "azure.*" and (
  event.action : ("Add*", "Update*", "Delete*", "Consent*") and
  not user.name : "service-*"
) or (
  event.dataset == "azure.signinlogs" and
  event.outcome == "success" and
  source.as.organization.name : ("Tor*", "VPN*")
)

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
    LOGSOURCENAME(logsourceid) AS LogSource,
    "username" AS UserPrincipalName,
    sourceip AS SourceIP,
    "EventName" AS Operation,
    CASE
        WHEN "EventName" ILIKE '%delete%' OR "EventName" ILIKE '%remove%' THEN 85
        WHEN "EventName" ILIKE '%add%' OR "EventName" ILIKE '%create%' THEN 70
        WHEN "EventName" ILIKE '%update%' THEN 65
        ELSE 55
    END AS RiskScore
FROM events
WHERE
    LOGSOURCETYPENAME(devicetype) IN ('Microsoft Azure', 'Azure Active Directory Audit Log')
    AND ("EventName" ILIKE '%subscription%'
        OR "EventName" ILIKE '%consent%'
        OR "EventName" ILIKE '%permission%'
        OR "EventName" ILIKE '%role%')
    AND RiskScore >= 65
ORDER BY EventTime DESC
LAST 24 HOURS

_sourceCategory=azure/audit OR _sourceCategory=azure/signin
| json auto
| where operation_name matches /(add|delete|update|consent|create)/i
| where !(initiated_by_user matches /service-/) 
| if(result_reason matches /fail/i, "Failed", "Success") as result
| if(operation_name matches /delete/i, 85,
    if(operation_name matches /consent/i, 80,
    if(operation_name matches /(add|create)/i, 70, 55))) as risk_score
| where risk_score >= 70
| count by initiated_by_user, operation_name, target_display_name, risk_score, source_ip
| sort - risk_score

rule detection_t1666 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects Modify Cloud Resource Hierarchy cloud activity - T1666"
    severity = "HIGH"
    mitre_attack = "T1666"
    reference = "https://attack.mitre.org/techniques/T1666/"

  events:
    $e.metadata.event_type = "USER_CHANGE"
    $e.principal.user.userid = $user
    $e.principal.ip = $source_ip
    $e.target.resource.name = $resource
    (
      re.regex($e.metadata.product_event_type, `(?i)(add|delete|consent|update|create)`) and
      not re.regex($e.principal.user.userid, `(?i)(service-|automation-|pipeline-)`)
    )

  condition:
    $e
}

#event_simpleName = "UserActivityAuditEvent"
| EventName = /(?i)(add|delete|consent|update|create)/
| UserName != /(?i)(service-|automation-|pipeline-)/
| case {
    EventName = /(?i)delete/ | RiskScore := "High" ;
    EventName = /(?i)consent/ | RiskScore := "High" ;
    EventName = /(?i)(add|create)/ | RiskScore := "Medium" ;
    * | RiskScore := "Low"
}
| RiskScore != "Low"
| table([UserName, EventName, TargetObjectId, SourceIPAddress, RiskScore, @timestamp])
| sort(@timestamp, order=desc, limit=100)