From c9789c3186f00fa41b52fbda4e31630be2c697dc Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 24 Apr 2023 16:26:04 -0400
Subject: [PATCH 01/14] adding new analytic story

---
 ..._active_directory_privilege_escalation.yml | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 stories/azure_active_directory_privilege_escalation.yml

diff --git a/stories/azure_active_directory_privilege_escalation.yml b/stories/azure_active_directory_privilege_escalation.yml
new file mode 100644
index 0000000000..3b5f89d0a5
--- /dev/null
+++ b/stories/azure_active_directory_privilege_escalation.yml
@@ -0,0 +1,20 @@
+name: Azure Active Directory Privilege Escalation
+id: ec78e872-b79c-417d-b256-8fde902522fb
+version: 1
+date: '2023-04-24'
+author: Mauricio Velazco, Splunk
+description: UPDATE_DESCRIPTION
+narrative: UPDATE_NARRATIVE
+references: []
+tags:
+  analytic_story: Azure Active Directory Privilege Escalation
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Cloud Security
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring

From 8a71193989e3403db4838882a145f9851bdb27b0 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 25 Apr 2023 14:23:38 -0400
Subject: [PATCH 02/14] updating detection

---
 ...ad_service_principal_new_client_credentials.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml
index e3ce6d82b6..b8342f6141 100644
--- a/detections/cloud/azure_ad_service_principal_new_client_credentials.yml
+++ b/detections/cloud/azure_ad_service_principal_new_client_credentials.yml
@@ -1,18 +1,20 @@
 name: Azure AD Service Principal New Client Credentials
 id: e3adc0d3-9e4b-4b5d-b662-12cec1adff2a
-version: 1
+version: 2
 date: '2022-08-17'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: The following analytic identifies the creation of credentials for Service
+description: The following analytic identifies the addition of new credentials for Service
   Principals and Applications in addition to existing legitimate credentials in Azure
   AD. These credentials include both x509 certificates and passwords. With sufficient
   permissions, there are a variety of ways to add credentials including the Azure
   Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries
   and red teams alike who have obtained privileged access to Azure AD may add credentials
   to Service Principals to maintain persistent access to victim accounts and other
-  instances within the Azure environment.
+  instances within the Azure environment. By compromising an account who is an Owner of an application
+  with privileged access, attackers may also escalate their privileges in an Azure AD environment by adding new credentials and 
+  logging in as the service principal.
 data_source: []
 search: ' `azuread` body.category=AuditLogs body.operationName="Update application*Certificates
   and secrets management " | rename body.* as * | rename properties.* as * | rename
@@ -30,11 +32,13 @@ references:
 - https://hausec.com/2021/10/26/attacking-azure-azure-ad-part-ii/
 - https://www.inversecos.com/2021/10/how-to-backdoor-azure-applications-and.html
 - https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT405/AZT405-3/
 tags:
   analytic_story:
   - Azure Active Directory Persistence
+  - Azure Active Directory Privilege Escalation
   asset_type: Azure Active Directory
-  confidence: 90
+  confidence: 50
   impact: 70
   message: New credentials added for Service Principal $body.properties.targetResources{}.displayName$
   mitre_attack_id:
@@ -60,7 +64,7 @@ tags:
   - body.properties.initiatedBy.user.userPrincipalName
   - body.properties.targetResources{}.displayName
   - body.properties.targetResources{}.modifiedProperties{}.newValue
-  risk_score: 63
+  risk_score: 35
   security_domain: threat
 tests:
 - name: True Positive Test

From b5c1e2380186baddb659bf9bd29ce311719af094 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 25 Apr 2023 14:55:48 -0400
Subject: [PATCH 03/14] updating detection

---
 .../cloud/azure_ad_global_administrator_role_assigned.yml    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/azure_ad_global_administrator_role_assigned.yml b/detections/cloud/azure_ad_global_administrator_role_assigned.yml
index eb3f6fb424..023ece5b98 100644
--- a/detections/cloud/azure_ad_global_administrator_role_assigned.yml
+++ b/detections/cloud/azure_ad_global_administrator_role_assigned.yml
@@ -1,6 +1,6 @@
 name: Azure AD Global Administrator Role Assigned
 id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
-version: 1
+version: 2
 date: '2022-08-17'
 author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
 status: production
@@ -12,7 +12,7 @@ description: The following analytic identifies the assignment of the Azure AD Gl
   in an Active Directory environment. While Azure AD roles do not grant access to
   Azure services and resources, it is possible for a Global Administrator account
   to gain control of Azure resources. Adversaries and red teams alike may assign this
-  role to a compromised account to establish Persistence in an Azure AD environment.
+  role to a compromised account to establish Persistence or escalate their privileges in an Azure AD environment.
 data_source: []
 search: '`azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global
   Administrator\"" | rename body.properties.* as * | rename targetResources{}.userPrincipalName
@@ -35,6 +35,7 @@ references:
 tags:
   analytic_story:
   - Azure Active Directory Persistence
+  - Azure Active Directory Privilege Escalation
   asset_type: Azure Active Directory
   confidence: 90
   impact: 80

From 50a09ee19fbbf1fa11c05f76b3929be3a177a296 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 25 Apr 2023 15:07:55 -0400
Subject: [PATCH 04/14] updating detection

---
 detections/cloud/azure_ad_service_principal_owner_added.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml
index 1fe76ed476..6983a723ec 100644
--- a/detections/cloud/azure_ad_service_principal_owner_added.yml
+++ b/detections/cloud/azure_ad_service_principal_owner_added.yml
@@ -1,6 +1,6 @@
 name: Azure AD Service Principal Owner Added
 id: 7ddf2084-6cf3-4a44-be83-474f7b73c701
-version: 1
+version: 2
 date: '2022-08-30'
 author: Mauricio Velazco, Splunk
 status: production
@@ -12,7 +12,8 @@ description: The following analytic identifies the addition of a new owner for a
   Principal authentication does not support multi-factor authentication nor conditional
   access policies. Adversaries and red teams alike who have obtained administrative
   access may add a new owner for an existing Service Principal to establish Persistence
-  and obtain single-factor access to an Azure AD environment.
+  and obtain single-factor access to an Azure AD environment. Attackers who are looking to
+  escalate their privileges by leveraging a Service Principals permissions may also add a new owner.
 data_source: []
 search: ' `azuread` body.operationName="Add owner to application" | rename body.properties.*
   as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName
@@ -31,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Azure Active Directory Persistence
+  - Azure Active Directory Privilege Escalation
   asset_type: Azure Active Directory
   confidence: 90
   impact: 60

From 1841df5e4f619e76267bff5b0a69c462f597c9fb Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 25 Apr 2023 16:11:37 -0400
Subject: [PATCH 05/14] adding detection

---
 ...pplication_administrator_role_assigned.yml | 66 +++++++++++++++++++
 lookups/privileged_azure_ad_roles.csv         |  1 -
 2 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 detections/cloud/azure_ad_application_administrator_role_assigned.yml

diff --git a/detections/cloud/azure_ad_application_administrator_role_assigned.yml b/detections/cloud/azure_ad_application_administrator_role_assigned.yml
new file mode 100644
index 0000000000..93b1c0ad8a
--- /dev/null
+++ b/detections/cloud/azure_ad_application_administrator_role_assigned.yml
@@ -0,0 +1,66 @@
+name: Azure AD Application Administrator Role Assigned
+id: eac4de87-7a56-4538-a21b-277897af6d8d
+version: 1
+date: '2023-04-25'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user
+search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\"" 
+  | rename body.properties.* as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName 
+  | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
+  | `azure_ad_application_administrator_role_assigned_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Administrators may legitimately assign the Application Administrator
+  role to a user. Filter as needed.
+references:
+- https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/
+- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
+- https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roles
+- https://attack.mitre.org/techniques/T1098/003/
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  asset_type: Azure Active Directory
+  atomic_guid: []
+  confidence: 50
+  impact: 70
+  message: The privileged Azure AD role Application Administrator was assigned for User $userPrincipalName$ initiated
+    by $initiatedBy$
+  mitre_attack_id:
+  - T1098
+  - T1098.003
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: initiatedBy
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.targetResources{}.userPrincipalName
+  - body.properties.targetResources{}.type
+  - body.properties.initiatedBy.user.userPrincipalName
+  - body.properties.result
+  risk_score: 35
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true
\ No newline at end of file
diff --git a/lookups/privileged_azure_ad_roles.csv b/lookups/privileged_azure_ad_roles.csv
index 877df539cd..22cb717fe6 100644
--- a/lookups/privileged_azure_ad_roles.csv
+++ b/lookups/privileged_azure_ad_roles.csv
@@ -1,5 +1,4 @@
 azureadrole,isprvilegedadrole,description
-"""Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps.
 """Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user.
 """Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.
 """Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices.

From 39a1645e69a62c9d3fa5bfad44b3477d403dde48 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 25 Apr 2023 17:04:46 -0400
Subject: [PATCH 06/14] adding new detection

---
 ...pplication_administrator_role_assigned.yml |  3 +-
 ...entication_administrator_role_assigned.yml | 61 +++++++++++++++++++
 lookups/privileged_azure_ad_roles.csv         |  1 -
 3 files changed, 63 insertions(+), 2 deletions(-)
 create mode 100644 detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml

diff --git a/detections/cloud/azure_ad_application_administrator_role_assigned.yml b/detections/cloud/azure_ad_application_administrator_role_assigned.yml
index 93b1c0ad8a..2a2ee42188 100644
--- a/detections/cloud/azure_ad_application_administrator_role_assigned.yml
+++ b/detections/cloud/azure_ad_application_administrator_role_assigned.yml
@@ -6,7 +6,7 @@ author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 data_source: []
-description: The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user
+description: The following analytic identifies the assignment of the Azure Application Administrator role to an Azure AD user.
 search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\"" 
   | rename body.properties.* as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName 
@@ -24,6 +24,7 @@ references:
 - https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
 - https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roles
 - https://attack.mitre.org/techniques/T1098/003/
+- https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator
 tags:
   analytic_story:
   - Azure Active Directory Privilege Escalation
diff --git a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml
new file mode 100644
index 0000000000..8df6d15b99
--- /dev/null
+++ b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml
@@ -0,0 +1,61 @@
+name: Azure AD Privileged Authentication Administrator Role Assigned
+id: a7da845d-6fae-41cf-b823-6c0b8c55814a
+version: 1
+date: '2023-04-25'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic identifies the assignment of the Azure Application Administrator role to an Azure AD user.
+search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" 
+  | rename body.properties.* as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName 
+  | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName
+  | `azure_ad_privileged_authentication_administrator_role_assigned_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Administrators may legitimately assign the Privileged Authentication Administrator role
+  as part of administrative tasks. Filter as needed.
+references:
+- https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-authentication-administrator
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  asset_type: Azure Active Directory
+  confidence: 50
+  impact: 100
+  message: The privileged Azure AD role Privileged Authentication Administrator was assigned for User $userPrincipalName$ initiated
+    by $initiatedBy$
+  mitre_attack_id:
+  - T1003.002
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: initiatedBy
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - body.properties.targetResources{}.userPrincipalName
+  - body.properties.targetResources{}.type
+  - body.properties.initiatedBy.user.userPrincipalName
+  - body.properties.result
+  risk_score: 50
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true
\ No newline at end of file
diff --git a/lookups/privileged_azure_ad_roles.csv b/lookups/privileged_azure_ad_roles.csv
index 22cb717fe6..4a3e41649c 100644
--- a/lookups/privileged_azure_ad_roles.csv
+++ b/lookups/privileged_azure_ad_roles.csv
@@ -17,7 +17,6 @@ azureadrole,isprvilegedadrole,description
 """License Administrator""",True,Can manage product licenses on users and groups.
 """Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications.
 """Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators.
-"""Privileged Authentication Administrator""",True,Can access to view, set and reset authentication method information for any user (admin or non-admin).
 """Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management.
 """Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365.
 """SharePoint Administrator""",True,Can manage all aspects of the SharePoint service.

From 7e4a51ec5ea7322ed824c0365fa71866458e82b7 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 25 Apr 2023 17:39:10 -0400
Subject: [PATCH 07/14] updating descriptions

---
 .../azure_ad_application_administrator_role_assigned.yml   | 7 ++++++-
 ...ivileged_authentication_administrator_role_assigned.yml | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/azure_ad_application_administrator_role_assigned.yml b/detections/cloud/azure_ad_application_administrator_role_assigned.yml
index 2a2ee42188..bc539356c0 100644
--- a/detections/cloud/azure_ad_application_administrator_role_assigned.yml
+++ b/detections/cloud/azure_ad_application_administrator_role_assigned.yml
@@ -6,7 +6,12 @@ author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 data_source: []
-description: The following analytic identifies the assignment of the Azure Application Administrator role to an Azure AD user.
+description: The following analytic identifies the assignment of the Application Administrator role to an Azure AD user. Users in this role can create and manage all 
+  aspects of enterprise applications, application registrations, and application proxy settings. This role also grants the ability to manage application credentials.
+  Users assigned this role can add credentials to an application, and use those credentials to impersonate the applications identity. If the applications identity has 
+  been granted access to a resource, such as the ability to create or update User or other objects, then a user assigned to this role could perform those actions while
+  impersonating the application. This ability to impersonate the applications identity may be an elevation of privilege over what the user can do via their role assignments.
+  Red teams and adversaries alike may abuse this role to escalate their privileges in an Azure AD tenant.
 search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Application Administrator\"" 
   | rename body.properties.* as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName 
diff --git a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml
index 8df6d15b99..a970d1aae4 100644
--- a/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml
+++ b/detections/cloud/azure_ad_privileged_authentication_administrator_role_assigned.yml
@@ -6,7 +6,10 @@ author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 data_source: []
-description: The following analytic identifies the assignment of the Azure Application Administrator role to an Azure AD user.
+description: The following analytic identifies the assignment of the Privileged Authentication Administrato role to an Azure AD user. Users in this role can set or reset authentication
+  methods for any user in Azure Active Directory, including privileged roles like Global Administrators. Users with this role can change credentials for people who may have access to sensitive
+  or private information or critical configuration inside and outside of Azure Active Directory. Changing the credentials of a user may mean the ability to assume that users identity and permissions.
+  Red teams and adversaries alike may abuse this role to escalate their privileges.
 search: ' `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" 
   | rename body.properties.* as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName 
@@ -21,6 +24,8 @@ known_false_positives: Administrators may legitimately assign the Privileged Aut
   as part of administrative tasks. Filter as needed.
 references:
 - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-authentication-administrator
+- https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48
+- https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
 tags:
   analytic_story:
   - Azure Active Directory Privilege Escalation

From a6ed51c1a85e0564ca51064a726bbb0891a5458f Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 26 Apr 2023 18:03:46 -0400
Subject: [PATCH 08/14] adding new detection

---
 ...azure_ad_pim_role_assignment_activated.yml | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 detections/cloud/azure_ad_pim_role_assignment_activated.yml

diff --git a/detections/cloud/azure_ad_pim_role_assignment_activated.yml b/detections/cloud/azure_ad_pim_role_assignment_activated.yml
new file mode 100644
index 0000000000..0625a7bc2d
--- /dev/null
+++ b/detections/cloud/azure_ad_pim_role_assignment_activated.yml
@@ -0,0 +1,52 @@
+name: Azure AD PIM Role Assignment Activated
+id: 952e80d0-e343-439b-83f4-808c3e6fbf2e
+version: 1
+date: '2023-04-26'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: UPDATE_DESCRIPTION
+search: ' `azuread` completed operationName="Add member to role completed (PIM activation)"
+  | rename properties.* as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
+  | stats values(userPrincipalName) values(targetResources{}.displayName) by _time, initiatedBy, result, operationName,
+  | `azure_ad_pim_role_assignment_activated_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: As part of legitimate administrative behavior, users may activate PIM roles. Filter as needed
+references:
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT401/AZT401/
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  asset_type: Azure Active Directory
+  confidence: 50
+  impact: 70
+  message: Azure AD PIM Role Assignment was activated by $initiatedBy$
+  mitre_attack_id:
+  - T1098
+  - T1098.003
+  observable:
+  - name: UPDATE
+    type: UPDATE
+    role:
+    - UPDATE
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 35
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit.log
+    source: eventhub://researchhub1.servicebus.windows.net/azureadhub;
+    sourcetype: mscs:azure:eventhub

From 89e3612faca270b2df94fd84d420ec32f141ab48 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 26 Apr 2023 18:21:33 -0400
Subject: [PATCH 09/14] adding new detection

---
 .../cloud/azure_ad_pim_role_assigned.yml      | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 detections/cloud/azure_ad_pim_role_assigned.yml

diff --git a/detections/cloud/azure_ad_pim_role_assigned.yml b/detections/cloud/azure_ad_pim_role_assigned.yml
new file mode 100644
index 0000000000..9747f406e9
--- /dev/null
+++ b/detections/cloud/azure_ad_pim_role_assigned.yml
@@ -0,0 +1,52 @@
+name: Azure AD PIM Role Assigned
+id: fcd6dfeb-191c-46a0-a29c-c306382145ab
+version: 1
+date: '2023-04-26'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+data_source: []
+description: UPDATE_DESCRIPTION
+search: ' `azuread` completed operationName="Add eligible member to role in PIM completed*"
+  | rename properties.* as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName 
+  | stats values(userPrincipalName) values(targetResources{}.displayName) by _time, result, operationName, initiatedBy.user.displayName
+  | `azure_ad_pim_role_assigned_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: As part of legitimate administrative behavior, users may be assigned PIM roles. Filter as needed
+references:
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT401/AZT401/
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  asset_type: Azure Active Directory
+  confidence: 50
+  impact: 70
+  message: UPDATE message
+  mitre_attack_id:
+  - T1098
+  - T1098.003
+  observable:
+  - name: UPDATE
+    type: UPDATE
+    role:
+    - UPDATE
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 35
+  required_fields:
+  - _time
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit.log
+    source: eventhub://researchhub1.servicebus.windows.net/azureadhub;
+    sourcetype: mscs:azure:eventhub
\ No newline at end of file

From 9470ecba23704f15350568a7d571f2406d80c449 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Thu, 27 Apr 2023 13:55:17 -0400
Subject: [PATCH 10/14] updated detection descriptions

---
 .../cloud/azure_ad_pim_role_assigned.yml      | 23 ++++++++++++++-----
 ...azure_ad_pim_role_assignment_activated.yml | 23 ++++++++++++++-----
 2 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/detections/cloud/azure_ad_pim_role_assigned.yml b/detections/cloud/azure_ad_pim_role_assigned.yml
index 9747f406e9..27bc18b203 100644
--- a/detections/cloud/azure_ad_pim_role_assigned.yml
+++ b/detections/cloud/azure_ad_pim_role_assigned.yml
@@ -6,8 +6,13 @@ author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 data_source: []
-description: UPDATE_DESCRIPTION
-search: ' `azuread` completed operationName="Add eligible member to role in PIM completed*"
+description: The following analytic identifies the assignment of the Azure AD PIM role. Privileged Identity Management (PIM) is a service within Azure Azure AD 
+  that enables administrators to manage, control, and monitor access to sensitive resources. PIM provides time-based and approval-based role activation to mitigate the
+  risks of excessive, unnecessary, or misused access permissions on resources. Once a user has been made eligible for an administrative role, she must activate this role
+  assignment to perform the privileged actions. When a role is activated, Azure AD PIM temporarily adds active assignment for the role. While PIM can be leveraged as a powerful
+  security control, it may also abused by adversaries to obtain privileged access. Security teams should monitor for the assignment and activation of PIM roles and validate their
+  legitimacy.
+search: ' `azuread` operationName="Add eligible member to role in PIM completed*"
   | rename properties.* as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName 
   | stats values(userPrincipalName) values(targetResources{}.displayName) by _time, result, operationName, initiatedBy.user.displayName
@@ -24,18 +29,19 @@ references:
 tags:
   analytic_story:
   - Azure Active Directory Privilege Escalation
+  - Azure Active Directory Persistence
   asset_type: Azure Active Directory
   confidence: 50
   impact: 70
-  message: UPDATE message
+  message: An Azure AD PIM role assignment was assiged to $userPrincipalName$
   mitre_attack_id:
   - T1098
   - T1098.003
   observable:
-  - name: UPDATE
-    type: UPDATE
+  - name: userPrincipalName
+    type: User
     role:
-    - UPDATE
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -43,6 +49,11 @@ tags:
   risk_score: 35
   required_fields:
   - _time
+  - properties
+  - operationName
+  - userPrincipalName
+  - initiatedBy.user.userPrincipalName 
+  - result
   security_domain: identity
 tests:
 - name: True Positive Test
diff --git a/detections/cloud/azure_ad_pim_role_assignment_activated.yml b/detections/cloud/azure_ad_pim_role_assignment_activated.yml
index 0625a7bc2d..d987c26dfb 100644
--- a/detections/cloud/azure_ad_pim_role_assignment_activated.yml
+++ b/detections/cloud/azure_ad_pim_role_assignment_activated.yml
@@ -6,8 +6,13 @@ author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 data_source: []
-description: UPDATE_DESCRIPTION
-search: ' `azuread` completed operationName="Add member to role completed (PIM activation)"
+description: The following analytic identifies the assignment of the Azure AD PIM role. Privileged Identity Management (PIM) is a service within Azure Azure AD 
+  that enables administrators to manage, control, and monitor access to sensitive resources. PIM provides time-based and approval-based role activation to mitigate the
+  risks of excessive, unnecessary, or misused access permissions on resources. Once a user has been made eligible for an administrative role, she must activate this role
+  assignment to perform the privileged actions. When a role is activated, Azure AD PIM temporarily adds active assignment for the role. While PIM can be leveraged as a powerful
+  security control, it may also abused by adversaries to obtain privileged access. Security teams should monitor for the assignment and activation of PIM roles and validate their
+  legitimacy.
+search: ' `azuread` operationName="Add member to role completed (PIM activation)"
   | rename properties.* as * 
   | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy
   | stats values(userPrincipalName) values(targetResources{}.displayName) by _time, initiatedBy, result, operationName,
@@ -24,24 +29,30 @@ references:
 tags:
   analytic_story:
   - Azure Active Directory Privilege Escalation
+  - Azure Active Directory Persistence
   asset_type: Azure Active Directory
   confidence: 50
   impact: 70
-  message: Azure AD PIM Role Assignment was activated by $initiatedBy$
+  message: An Azure AD PIM role assignment was activated by $initiatedBy$
   mitre_attack_id:
   - T1098
   - T1098.003
   observable:
-  - name: UPDATE
-    type: UPDATE
+  - name: userPrincipalName
+    type: User
     role:
-    - UPDATE
+    - Attacker
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
+  - properties
+  - operationName
+  - userPrincipalName
+  - initiatedBy.user.userPrincipalName 
+  - result
   risk_score: 35
   security_domain: identity
 tests:

From 2b68fab81cde8341054e73f6e11c6f040663e0e3 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Fri, 28 Apr 2023 14:48:34 -0400
Subject: [PATCH 11/14] adding new detection

---
 .../azure_ad_privileged_role_assigned.yml     | 16 +++--
 ...ged_role_assigned_to_service_principal.yml | 64 +++++++++++++++++++
 2 files changed, 73 insertions(+), 7 deletions(-)
 create mode 100644 detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml

diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml
index 58bd81c37a..587b9b1738 100644
--- a/detections/cloud/azure_ad_privileged_role_assigned.yml
+++ b/detections/cloud/azure_ad_privileged_role_assigned.yml
@@ -10,13 +10,15 @@ description: The following analytic identifies the assignment of sensitive and p
   may assign these roles to a compromised account to establish Persistence in an Azure
   AD environment.
 data_source: []
-search: ' `azuread` "body.operationName"="Add member to role" | rename body.properties.*
-  as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename
-  initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.modifiedProperties{}.newValue
-  as roles | eval role=mvindex(roles,1) | lookup privileged_azure_ad_roles azureadrole
-  AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True |
-  stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName,
-  role, description | `azure_ad_privileged_role_assigned_filter`'
+search: ' `azuread` "body.operationName"="Add member to role" | rename body.properties.*  as * 
+  | rename targetResources{}.userPrincipalName as userPrincipalName 
+  | rename initiatedBy.user.userPrincipalName as initiatedBy 
+  | rename targetResources{}.modifiedProperties{}.newValue  as roles 
+  | eval role=mvindex(roles,1) 
+  | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description 
+  | search isprvilegedadrole = True
+  | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description 
+  | `azure_ad_privileged_role_assigned_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
   Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
   You must be ingesting Azure Active Directory events into your Splunk environment.
diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
new file mode 100644
index 0000000000..d8a3c1e196
--- /dev/null
+++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
@@ -0,0 +1,64 @@
+name: Azure AD Privileged Role Assigned to Service Principal
+id: 5dfaa3d3-e2e4-4053-8252-16d9ee528c41
+version: 1
+date: '2023-04-28'
+author: Mauricio Velazco, Splunk
+status: production
+type: TTP
+description: UPDATE_DESCRIPTION
+data_source: []
+search: ' `azuread` operationName="Add member to role" 
+  | rename properties.* as *
+  | search "targetResources{}.type"=ServicePrincipal
+  | rename initiatedBy.user.userPrincipalName as initiatedBy 
+  | rename targetResources{}.modifiedProperties{}.newValue  as roles 
+  | eval role=mvindex(roles,1) 
+  | rename targetResources{}.displayName as apps
+  | eval displayName=mvindex(apps,0) 
+  | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description 
+  | search isprvilegedadrole = True
+  | stats values(displayName) by _time, initiatedBy, result, operationName, role
+  | `azure_ad_privileged_role_assigned_to_service_principal_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft
+  Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details).
+  You must be ingesting Azure Active Directory events into your Splunk environment.
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Administrators may legitimately assign the privileged roles
+  to Service Principals as part of administrative tasks. Filter as needed.
+references:
+- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
+tags:
+  analytic_story:
+  - Azure Active Directory Privilege Escalation
+  asset_type: Azure Active Directory
+  confidence: 50
+  impact: 70
+  message: A privileged Azure AD role was assigned to the Service Principal $displayName$ initiated
+    by $initiatedBy$
+  mitre_attack_id:
+  - T1098
+  - T1098.003
+  observable:
+  - name: initiatedBy
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 35
+  required_fields:
+  - _time
+  - properties.targetResources{}.userPrincipalName
+  - properties.targetResources{}.type
+  - properties.initiatedBy.user.userPrincipalName
+  - properties.result
+  security_domain: identity
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

From d7c5f650922a9a862c58c0e9e4658b781113b984 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Fri, 28 Apr 2023 15:59:42 -0400
Subject: [PATCH 12/14] Update
 azure_ad_privileged_role_assigned_to_service_principal.yml

---
 .../azure_ad_privileged_role_assigned_to_service_principal.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
index d8a3c1e196..6f6fa725b2 100644
--- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
+++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
@@ -5,7 +5,7 @@ date: '2023-04-28'
 author: Mauricio Velazco, Splunk
 status: production
 type: TTP
-description: UPDATE_DESCRIPTION
+description: The following analytic
 data_source: []
 search: ' `azuread` operationName="Add member to role" 
   | rename properties.* as *

From 42d611807297ddda5255bdb261cd6bcc68927e8e Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Fri, 28 Apr 2023 16:28:06 -0400
Subject: [PATCH 13/14] updating dataset url

---
 .../azure_ad_privileged_role_assigned_to_service_principal.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
index 6f6fa725b2..528440d3b6 100644
--- a/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
+++ b/detections/cloud/azure_ad_privileged_role_assigned_to_service_principal.yml
@@ -58,7 +58,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/azure-audit.log
     source: mscs:azure:eventhub
     sourcetype: mscs:azure:eventhub
     update_timestamp: true

From 63bee455fc28851e4642c804d7c00d3f9b98788b Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 15 May 2023 14:38:58 -0400
Subject: [PATCH 14/14] Update azure_active_directory_privilege_escalation.yml

---
 ..._active_directory_privilege_escalation.yml | 24 ++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/stories/azure_active_directory_privilege_escalation.yml b/stories/azure_active_directory_privilege_escalation.yml
index 3b5f89d0a5..dbee9909d6 100644
--- a/stories/azure_active_directory_privilege_escalation.yml
+++ b/stories/azure_active_directory_privilege_escalation.yml
@@ -3,9 +3,27 @@ id: ec78e872-b79c-417d-b256-8fde902522fb
 version: 1
 date: '2023-04-24'
 author: Mauricio Velazco, Splunk
-description: UPDATE_DESCRIPTION
-narrative: UPDATE_NARRATIVE
-references: []
+description: Monitor for activities and techniques associated with Privilege Escalation
+  attacks within Azure Active Directory tenants.
+narrative: Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. 
+  Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. 
+  Common approaches are to take advantage of system weaknesses, misconfigurations or vulnerabilities.\
+
+  Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure
+  services like Office 365 and Microsoft Teams. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. 
+  According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\
+
+  Privilege escalation attacks in Azure AD typically involve abusing  misconfigurations to gain elevated privileges,
+  such as Global Administrator access. Once an attacker has escalated their privileges and taken full control of a tenant, they may abuse every service that leverages Azure AD including
+  moving laterally to Azure virtual machines to access sensitive data and carry out further attacks. Security teams should monitor for 
+  privilege escalation attacks in Azure Active Directory to identify breaches before attackers achieve operational success.\
+   
+  The following analytic story groups detection opportunities that seek to identify an adversary attempting to escalate privileges in Azure AD tenants.
+references:
+- https://attack.mitre.org/tactics/TA0003/
+- https://cloudbrothers.info/en/azure-attack-paths/
+- https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/PrivEsc/
+- https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
 tags:
   analytic_story: Azure Active Directory Privilege Escalation
   category: