Changes To Azure Lighthouse Delegation

AzureActivity | where OperationNameValue =~ "Microsoft.ManagedServices/registrationAssignments/Write" | summarize ActivityStatusValue=make_list(ActivityStatusValue), timestamp = max(TimeGenerated) by IPCustomEntity=CallerIpAddress, AccountCustomEntity=Caller, SubscriptionId, OperationNameValue, CorrelationId

Explanation

This query is used to identify when Azure Lighthouse is used to delegate resources for access through another Azure Active Directory tenant. It looks for a specific operation name related to registration assignments and summarizes the activity status and timestamp for each unique combination of caller IP address, caller account, subscription ID, operation name, and correlation ID. The query is scheduled to run once a day and has a medium severity level. It is relevant to the persistence tactic and the T1136 technique. The query also includes entity mappings for the Account and IP entities.

Details

Fabian Bader

Released: March 25, 2022

Tables

AzureActivity

Keywords

Azure LighthouseAzure Active DirectoryAzureActivityMicrosoft.ManagedServices/registrationAssignments/WriteCallerIpAddressCallerSubscriptionIdOperationNameValueCorrelationIdAccountCustomEntityIPCustomEntityFullNameAddress

Operators

|=~make_list()max()

Severity

Medium

Tactics

Persistence

MITRE Techniques

T1136

Frequency: 1d

Period: 1d

KQL Search