User Granted Access and Grants Access to Other Users

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query identifies when a new user is granted access and starts granting access to other users. This can help you identify rogue or malicious user behavior.

Attribute	Value
Type	Hunting Query
Solution	Cloud Identity Threat Protection Essentials
ID	2b6a3882-d601-4298-983b-880f6dc7acdb
Tactics	Persistence, PrivilegeEscalation
Techniques	T1098, T1078
Required Connectors	AzureActiveDirectory
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
AuditLogs	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Cloud Identity Threat Protection Essentials