From c9789c3186f00fa41b52fbda4e31630be2c697dc Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 24 Apr 2023 16:26:04 -0400
Subject: [PATCH] adding new analytic story

---
 ..._active_directory_privilege_escalation.yml | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 stories/azure_active_directory_privilege_escalation.yml

diff --git a/stories/azure_active_directory_privilege_escalation.yml b/stories/azure_active_directory_privilege_escalation.yml
new file mode 100644
index 0000000000..3b5f89d0a5
--- /dev/null
+++ b/stories/azure_active_directory_privilege_escalation.yml
@@ -0,0 +1,20 @@
+name: Azure Active Directory Privilege Escalation
+id: ec78e872-b79c-417d-b256-8fde902522fb
+version: 1
+date: '2023-04-24'
+author: Mauricio Velazco, Splunk
+description: UPDATE_DESCRIPTION
+narrative: UPDATE_NARRATIVE
+references: []
+tags:
+  analytic_story: Azure Active Directory Privilege Escalation
+  category:
+  - Adversary Tactics
+  - Account Compromise
+  - Cloud Security
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring