Dangerous API Permission Consented

Query

let DangerousAPIPermissions = dynamic({
    "9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8": "RoleManagement.ReadWrite.Directory -> Directly promote any user to global admin",
    "06b708a9-e830-4db3-a914-8e69da51d44f": "AppRoleAssignment.ReadWrite.All -> Grant RoleManagement.ReadWrite.Directory, then promote to global admin",
    "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9": "Application.ReadWrite.All -> Act as another entity e.g. a global admin user"
    });
AuditLogs
| where OperationName == "Add app role assignment to service principal"
| where Result =~ "success"
| mv-expand TargetResources
| where TargetResources.displayName == "Microsoft Graph"
| mv-expand TargetResources.modifiedProperties
| where TargetResources_modifiedProperties.displayName == "AppRole.Id"
// This permission was not part of this application before
| where isnull(TargetResources_modifiedProperties.oldValue)
// The new permission is part of the dangerous API permissions
| extend NewAPIPermission = trim('"', tostring(TargetResources_modifiedProperties.newValue))
| extend PotentialImpact = DangerousAPIPermissions[NewAPIPermission]
| where isnotempty(PotentialImpact)
| extend UserAgent = iff(AdditionalDetails[0].key == "User-Agent", tostring(AdditionalDetails[0].value), "")
| extend ServicePrincipalDisplayName = parse_json(tostring(parse_json(tostring(TargetResources.modifiedProperties))[6].newValue))
| extend ServicePrincipalObjectID = parse_json(tostring(parse_json(tostring(TargetResources.modifiedProperties))[5].newValue))
| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend InitiatingIpAddress = iff(isnotempty(InitiatedBy.user.ipAddress), tostring(InitiatedBy.user.ipAddress), tostring(InitiatedBy.app.ipAddress))

Explanation

This query is designed to identify instances where high privilege API permissions have been granted to an application. It checks if these permissions are necessary and suggests removing them if not. The query looks for audit logs where an app role assignment is added to a service principal with a successful result. It then expands the target resources and filters for those related to Microsoft Graph. The query further expands the modified properties and checks if the new permission is part of a list of dangerous API permissions. It retrieves additional details such as user agent, service principal display name, and initiating user or app. The query also includes custom incident configuration settings and alert details override.

Details

Fabian Bader

Released: August 28, 2023

Tables

AuditLogs

Keywords

DevicesIntuneUserAPIApplicationAuditLogsOperationNameResultTargetResourcesMicrosoft GraphAppRole.IdAdditionalDetailsUser-AgentServicePrincipalDisplayNameServicePrincipalObjectIDInitiatingUserOrAppInitiatingIpAddressPotentialImpactHighRiskApps

Operators

|====~mv-expandisnullisnotemptytrimtostringiffparse_jsonextend

Severity

High

Tactics

Persistence

Frequency: 31m

Period: 31m

Actions

GitHub

KQL Search