Suspicious granting of permissions to an account

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identifies IPs from which users grant access to other users on Azure resources and alerts when a previously unseen source IP address is used.

Attribute	Value
Type	Analytic Rule
Solution	Azure Activity
ID	b2c15736-b9eb-4dae-8b02-3016b6a45a32
Severity	Medium
Status	Available
Kind	Scheduled
Tactics	Persistence, PrivilegeEscalation
Techniques	T1098, T1548
Required Connectors	AzureActivity, BehaviorAnalytics
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
AzureActivity	?	✗	?
IdentityInfo	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to Azure Activity