Rare service principal sign-in followed by RBAC write

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This query hunts for uncommon service principal sign-ins that are quickly followed by Azure role assignment write operations.

Attribute	Value
Type	Hunting Query
Solution	Hybrid Attack - Cloud & Identity
ID	d4deaf24-f2cf-4ed8-b869-a057f865f08f
Tactics	CredentialAccess, PrivilegeEscalation, Persistence
Techniques	T1528, T1078.004, T1098
Required Connectors	AzureActiveDirectory, AzureActivity
Source	View on GitHub

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Hybrid Attack - Cloud & Identity