Branch was auto-updated.

detections/cloud/azure_ad_application_administrator_role_assigned.yml

@@ -0,0 +1,72 @@
+name: Azure AD Application Administrator Role Assigned
+id: eac4de87-7a56-4538-a21b-277897af6d8d
+version: 1
+date: '2023-04-25'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies the assignment of the Application Administrator role to an Azure AD user. Users in this role can create and manage all 
+  aspects of enterprise applications, application registrations, and application proxy settings. This role also grants the ability to manage application credentials.
+  Users assigned this role can add credentials to an application, and use those credentials to impersonate the applications identity. If the applications identity has 
+  been granted access to a resource, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while
+  impersonating the application. This ability to impersonate the applications identity may be an elevation of privilege over what the user can do via their role assignments.
+  Red teams and adversaries alike may abuse this role to escalate their privileges in an Azure AD tenant.
+search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\"" 
+  | rename body.properties.* as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName 
+  | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
+  | `azure_ad_application_administrator_role_assigned_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Administrators may legitimately assign the Application Administrator
+  role to a user. Filter as needed.
+references:
+- https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/
+- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
+- https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roles
+- https://attack.mitre.org/techniques/T1098/003/
+- https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  asset_type: Azure Active Directory
+  atomic_guid: []
+  confidence: 50
+  impact: 70
+  message: The privileged Azure AD role Application Administrator was assigned for User $userPrincipalName$ initiated
+    by $initiatedBy$
+  mitre_attack_id:
+  - T1098
+  - T1098.003
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: initiatedBy
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.targetResources{}.userPrincipalName
+  - body.properties.targetResources{}.type
+  - body.properties.initiatedBy.user.userPrincipalName
+  - body.properties.result
+  risk_score: 35
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

detections/cloud/azure_ad_global_administrator_role_assigned.yml

@@ -1,6 +1,6 @@
 name: Azure AD Global Administrator Role Assigned
 id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
-version: 1
+version: 2
 date: '2022-08-17'
 author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
 status: production
@@ -12,7 +12,7 @@ description: The following analytic identifies the assignment of the Azure AD Gl
   in an Active Directory environment. While Azure AD roles do not grant access to
   Azure services and resources, it is possible for a Global Administrator account
   to gain control of Azure resources. Adversaries and red teams alike may assign this
-  role to a compromised account to establish Persistence in an Azure AD environment.
+  role to a compromised account to establish Persistence or escalate their privileges in an Azure AD environment.
 data_source: []
 search: '`azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global
   Administrator\"" | rename body.properties.* as * | rename targetResources{}.userPrincipalName
@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Azure Active Directory Persistence
+  - Azure Active Directory Privilege Escalation
   asset_type: Azure Active Directory
   confidence: 90
   impact: 80

detections/cloud/azure_ad_pim_role_assigned.yml

@@ -0,0 +1,63 @@
+name: Azure AD PIM Role Assigned
+id: fcd6dfeb-191c-46a0-a29c-c306382145ab
+version: 1
+date: '2023-04-26'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies the assignment of the Azure AD PIM role. Privileged Identity Management (PIM) is a service within Azure Azure AD 
+  that enables administrators to manage, control, and monitor access to sensitive resources. PIM provides time-based and approval-based role activation to mitigate the
+  risks of excessive, unnecessary, or misused access permissions on resources. Once a user has been made eligible for an administrative role, she must activate this role
+  assignment to perform the privileged actions. When a role is activated, Azure AD PIM temporarily adds active assignment for the role. While PIM can be leveraged as a powerful
+  security control, it may also abused by adversaries to obtain privileged access. Security teams should monitor for the assignment and activation of PIM roles and validate their
+  legitimacy.
+search: ' `azuread` operationName="Add eligible member to role in PIM completed*"
+  | rename properties.* as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName 
+  | stats values(userPrincipalName) values(targetResources{}.displayName) by _time, result, operationName, initiatedBy.user.displayName
+  | `azure_ad_pim_role_assigned_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: As part of legitimate administrative behavior, users may be assigned PIM roles. Filter as needed
+references:
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT401/AZT401/
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  - Azure Active Directory Persistence
+  asset_type: Azure Active Directory
+  confidence: 50
+  impact: 70
+  message: An Azure AD PIM role assignment was assiged to $userPrincipalName$
+  mitre_attack_id:
+  - T1098
+  - T1098.003
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 35
+  required_fields:
+  - _time
+  - properties
+  - operationName
+  - userPrincipalName
+  - initiatedBy.user.userPrincipalName 
+  - result
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit.log
+    source: eventhub://researchhub1.servicebus.windows.net/azureadhub;
+    sourcetype: mscs:azure:eventhub

detections/cloud/azure_ad_pim_role_assignment_activated.yml

@@ -0,0 +1,63 @@
+name: Azure AD PIM Role Assignment Activated
+id: 952e80d0-e343-439b-83f4-808c3e6fbf2e
+version: 1
+date: '2023-04-26'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies the assignment of the Azure AD PIM role. Privileged Identity Management (PIM) is a service within Azure Azure AD 
+  that enables administrators to manage, control, and monitor access to sensitive resources. PIM provides time-based and approval-based role activation to mitigate the
+  risks of excessive, unnecessary, or misused access permissions on resources. Once a user has been made eligible for an administrative role, she must activate this role
+  assignment to perform the privileged actions. When a role is activated, Azure AD PIM temporarily adds active assignment for the role. While PIM can be leveraged as a powerful
+  security control, it may also abused by adversaries to obtain privileged access. Security teams should monitor for the assignment and activation of PIM roles and validate their
+  legitimacy.
+search: ' `azuread` operationName="Add member to role completed (PIM activation)"
+  | rename properties.* as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | stats values(userPrincipalName) values(targetResources{}.displayName) by _time, initiatedBy, result, operationName,
+  | `azure_ad_pim_role_assignment_activated_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: As part of legitimate administrative behavior, users may activate PIM roles. Filter as needed
+references:
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT401/AZT401/
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  - Azure Active Directory Persistence
+  asset_type: Azure Active Directory
+  confidence: 50
+  impact: 70
+  message: An Azure AD PIM role assignment was activated by $initiatedBy$
+  mitre_attack_id:
+  - T1098
+  - T1098.003
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties
+  - operationName
+  - userPrincipalName
+  - initiatedBy.user.userPrincipalName 
+  - result
+  risk_score: 35
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit.log
+    source: eventhub://researchhub1.servicebus.windows.net/azureadhub;
+    sourcetype: mscs:azure:eventhub

detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml

@@ -0,0 +1,66 @@
+name: Azure AD Privileged Authentication Administrator Role Assigned
+id: a7da845d-6fae-41cf-b823-6c0b8c55814a
+version: 1
+date: '2023-04-25'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies the assignment of the Privileged Authentication Administrato role to an Azure AD user. Users in this role can set or reset authentication
+  methods for any user in Azure Active Directory, including privileged roles like Global Administrators. Users with this role can change credentials for people who may have access to sensitive
+  or private information or critical configuration inside and outside of Azure Active Directory. Changing the credentials of a user may mean the ability to assume that users identity and permissions.
+  Red teams and adversaries alike may abuse this role to escalate their privileges.
+search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" 
+  | rename body.properties.* as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName 
+  | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
+  | `azure_ad_privileged_authentication_administrator_role_assigned_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Administrators may legitimately assign the Privileged Authentication Administrator role
+  as part of administrative tasks. Filter as needed.
+references:
+- https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-authentication-administrator
+- https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48
+- https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  asset_type: Azure Active Directory
+  confidence: 50
+  impact: 100
+  message: The privileged Azure AD role Privileged Authentication Administrator was assigned for User $userPrincipalName$ initiated
+    by $initiatedBy$
+  mitre_attack_id:
+  - T1003.002
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: initiatedBy
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.targetResources{}.userPrincipalName
+  - body.properties.targetResources{}.type
+  - body.properties.initiatedBy.user.userPrincipalName
+  - body.properties.result
+  risk_score: 50
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

detections/cloud/azure_ad_privileged_role_assigned.yml

@@ -10,13 +10,15 @@ description: The following analytic identifies the assignment of sensitive and p
   may assign these roles to a compromised account to establish Persistence in an Azure
   AD environment.
 data_source: []
-search: ' `azuread` "body.operationName"="Add member to role" | rename body.properties.*
-  as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename
-  initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.modifiedProperties{}.newValue
-  as roles | eval role=mvindex(roles,1) | lookup privileged_azure_ad_roles azureadrole
-  AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True |
-  stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName,
-  role, description | `azure_ad_privileged_role_assigned_filter`'
+search: ' `azuread` "body.operationName"="Add member to role" | rename body.properties.*  as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName 
+  | rename initiatedBy.user.userPrincipalName as initiatedBy 
+  | rename targetResources{}.modifiedProperties{}.newValue  as roles 
+  | eval role=mvindex(roles,1) 
+  | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description 
+  | search isprvilegedadrole = True
+  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description 
+  | `azure_ad_privileged_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
   You must be ingesting Azure Active Directory events into your Splunk environment.

detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml

@@ -0,0 +1,64 @@
+name: Azure AD Privileged Role Assigned to Service Principal
+id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41
+version: 1
+date: '2023-04-28'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+description: The following analytic
+data_source: []
+search: ' `azuread` operationName="Add member to role" 
+  | rename properties.* as *
+  | search "targetResources{}.type"=ServicePrincipal
+  | rename initiatedBy.user.userPrincipalName as initiatedBy 
+  | rename targetResources{}.modifiedProperties{}.newValue  as roles 
+  | eval role=mvindex(roles,1) 
+  | rename targetResources{}.displayName as apps
+  | eval displayName=mvindex(apps,0) 
+  | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description 
+  | search isprvilegedadrole = True
+  | stats values(displayName) by _time, initiatedBy, result, operationName, role
+  | `azure_ad_privileged_role_assigned_to_service_principal_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Administrators may legitimately assign the privileged roles
+  to Service Principals as part of administrative tasks. Filter as needed.
+references:
+- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  asset_type: Azure Active Directory
+  confidence: 50
+  impact: 70
+  message: A privileged Azure AD role was assigned to the Service Principal $displayName$ initiated
+    by $initiatedBy$
+  mitre_attack_id:
+  - T1098
+  - T1098.003
+  observable:
+  - name: initiatedBy
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 35
+  required_fields:
+  - _time
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

detections/cloud/azure_ad_service_principal_new_client_credentials.yml

@@ -1,18 +1,20 @@
 name: Azure AD Service Principal New Client Credentials
 id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a
-version: 1
+version: 2
 date: '2022-08-17'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: The following analytic identifies the creation of credentials for Service
+description: The following analytic identifies the addition of new credentials for Service
   Principals and Applications in addition to existing legitimate credentials in Azure
   AD. These credentials include both x509 certificates and passwords. With sufficient
   permissions, there are a variety of ways to add credentials including the Azure
   Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries
   and red teams alike who have obtained privileged access to Azure AD may add credentials
   to Service Principals to maintain persistent access to victim accounts and other
-  instances within the Azure environment.
+  instances within the Azure environment. By compromising an account who is an Owner of an application
+  with privileged access, attackers may also escalate their privileges in an Azure AD environment by adding new credentials and 
+  logging in as the service principal.
 data_source: []
 search: ' `azuread` body.category=AuditLogs body.operationName="Update application*Certificates
   and secrets management " | rename body.* as * | rename properties.* as * | rename
@@ -30,11 +32,13 @@ references:
 - https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/
 - https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
 - https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT405/AZT405-3/
 tags:
   analytic_story:
   - Azure Active Directory Persistence
+  - Azure Active Directory Privilege Escalation
   asset_type: Azure Active Directory
-  confidence: 90
+  confidence: 50
   impact: 70
   message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$
   mitre_attack_id:
@@ -60,7 +64,7 @@ tags:
   - body.properties.initiatedBy.user.userPrincipalName
   - body.properties.targetResources{}.displayName
   - body.properties.targetResources{}.modifiedProperties{}.newValue
-  risk_score: 63
+  risk_score: 35
   security_domain: threat
 tests:
 - name: True Positive Test

detections/cloud/azure_ad_service_principal_owner_added.yml

@@ -1,6 +1,6 @@
 name: Azure AD Service Principal Owner Added
 id: 7ddf2084-6cf3-4a44-be83-474f7b73c701
-version: 1
+version: 2
 date: '2022-08-30'
 author: Mauricio Velazco, Splunk
 status: production
@@ -12,7 +12,8 @@ description: The following analytic identifies the addition of a new owner for a
   Principal authentication does not support multi-factor authentication nor conditional
   access policies. Adversaries and red teams alike who have obtained administrative
   access may add a new owner for an existing Service Principal to establish Persistence
-  and obtain single-factor access to an Azure AD environment.
+  and obtain single-factor access to an Azure AD environment. Attackers who are looking to
+  escalate their privileges by leveraging a Service Principals permissions may also add a new owner.
 data_source: []
 search: ' `azuread` body.operationName="Add owner to application" | rename body.properties.*
   as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName
@@ -31,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Azure Active Directory Persistence
+  - Azure Active Directory Privilege Escalation
   asset_type: Azure Active Directory
   confidence: 90
   impact: 60

lookups/privileged_azure_ad_roles.csv

@@ -1,5 +1,4 @@
 azureadrole,isprvilegedadrole,description
-"""Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps.
 """Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user.
 """Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.
 """Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices.
@@ -18,7 +17,6 @@ azureadrole,isprvilegedadrole,description
 """License Administrator""",True,Can manage product licenses on users and groups.
 """Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications.
 """Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators.
-"""Privileged Authentication Administrator""",True,Can access to view, set and reset authentication method information for any user (admin or non-admin).
 """Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management.
 """Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365.
 """SharePoint Administrator""",True,Can manage all aspects of the SharePoint service.

stories/azure_active_directory_privilege_escalation.yml

@@ -0,0 +1,38 @@
+name: Azure Active Directory Privilege Escalation
+id: ec78e872-b79c-417d-b256-8fde902522fb
+version: 1
+date: '2023-04-24'
+author: Mauricio Velazco, Splunk
+description: Monitor for activities and techniques associated with Privilege Escalation
+  attacks within Azure Active Directory tenants.
+narrative: Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. 
+  Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. 
+  Common approaches are to take advantage of system weaknesses, misconfigurations or vulnerabilities.\
+
+  Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure
+  services like Office 365 and Microsoft Teams. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. 
+  According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\
+
+  Privilege escalation attacks in Azure AD typically involve abusing  misconfigurations to gain elevated privileges,
+  such as Global Administrator access. Once an attacker has escalated their privileges and taken full control of a tenant, they may abuse every service that leverages Azure AD including
+  moving laterally to Azure virtual machines to access sensitive data and carry out further attacks. Security teams should monitor for 
+  privilege escalation attacks in Azure Active Directory to identify breaches before attackers achieve operational success.\
+   
+  The following analytic story groups detection opportunities that seek to identify an adversary attempting to escalate privileges in Azure AD tenants.
+references:
+- https://attack.mitre.org/tactics/TA0003/
+- https://cloudbrothers.info/en/azure-attack-paths/
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/PrivEsc/
+- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
+tags:
+  analytic_story: Azure Active Directory Privilege Escalation
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Cloud Security
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring