KQL Search

This query is designed to detect changes in membership of privileged groups through provisioning operations, which is unusual and could indicate a security threat. Here's a simple breakdown:

1. Purpose: The query identifies when membership of important security groups (like Domain Admins, Global Administrators, or any group with names containing Admin, Tier0, Sensitive, etc.) is altered via provisioning processes. Such changes are not typical and should be investigated immediately.

2. Data Source: It uses logs from Azure Active Directory, specifically the AADProvisioningLogs.

3. Frequency: The query runs every hour and checks for changes made in the last two hours.

4. Severity: The alert generated by this query is marked as high severity due to the potential security implications.

5. Detection Logic:

   • It looks for successful provisioning operations.
   • It checks if the target of these operations is a group with a name indicating high privilege.
   • It examines if the changes involve group membership or role assignments.

6. Output: The query lists details like the time of change, the service principal name, the initiator of the change, the target group, and the type of operation performed.

7. Alerting: If such a change is detected, an alert is generated with a specific format, highlighting the service and group involved.

8. Incident Management: The system can create incidents for these alerts, grouping them by the cloud application involved, to help manage and investigate potential security incidents efficiently.

Overall, this query helps in monitoring and securing privileged group memberships by flagging unusual provisioning activities that could be indicative of unauthorized access or privilege escalation attempts.