adding new azure ad dataset

splunk · Apr 26, 2023 · 25ae41b · 25ae41b
1 parent 167d9d6
commit 25ae41b
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit.log b/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit.log
diff --git a/...s/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure_ad_pim_role_activated.yml b/...s/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure_ad_pim_role_activated.yml
@@ -0,0 +1,12 @@
+author: Mauricio Velazco
+id: b6b3a10d-c90b-4b2c-9c6b-e200d16f266f
+date: '2023-04-26'
+description: Manually assigned and activated an Azure AD PIM role
+environment: Azure AD tenant
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit.log
+sourcetypes:
+- mscs:azure:eventhub
+references:
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
+- https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role