MDI_Group_Memebership_Changes

id: b66fb322-247a-4472-a231-2533b34ed059
name: MDI_Group_Memebership_Changes
description: |
  Find accounts that have been added/removed from groups in AD.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - IdentityDirectoryEvents
tactics:
 - Credential Access
query: |
    //Added to group
    IdentityDirectoryEvents 
    | where Application == "Active Directory"
    | where ActionType == "Group Membership changed"
    | extend parsed=parse_json(AdditionalFields)
    | extend INITIATED_BY = iff( isnull(AdditionalFields.["ACTOR.ACCOUNT"]), AdditionalFields.["ACTOR.ACCOUNT"], AdditionalFields.["ACTOR.ACCOUNT"])
    | extend GROUP_CHANGED = iff( isnull(AdditionalFields.["TO.GROUP"]), AdditionalFields.["TO.GROUP"], AdditionalFields.["TO.GROUP"])
    | where GROUP_CHANGED <> ""
    | extend GROUP_ADDED = iff( isnull(AdditionalFields.["TARGET_OBJECT.GROUP"]), AdditionalFields.["TARGET_OBJECT.GROUP"], AdditionalFields.["TARGET_OBJECT.GROUP"])
    | extend USER_ADDED = iff( isnull(AdditionalFields.["TARGET_OBJECT.USER"]), AdditionalFields.["TARGET_OBJECT.USER"], AdditionalFields.["TARGET_OBJECT.USER"])
    | extend DEVICE_ADDED = iff( isnull(AdditionalFields.["TARGET_OBJECT.DEVICE"]), AdditionalFields.["TARGET_OBJECT.DEVICE"], AdditionalFields.["TARGET_OBJECT.DEVICE"])
    | project Timestamp, ActionType, INITIATED_BY, GROUP_CHANGED, GROUP_ADDED, USER_ADDED, DEVICE_ADDED,AdditionalFields

    //Removed from group
    IdentityDirectoryEvents 
    | where Application == "Active Directory"
    | where ActionType == "Group Membership changed"
    | extend parsed=parse_json(AdditionalFields)
    | extend INITIATED_BY = iff( isnull(AdditionalFields.["ACTOR.ACCOUNT"]), AdditionalFields.["ACTOR.ACCOUNT"], AdditionalFields.["ACTOR.ACCOUNT"])
    | extend GROUP_CHANGED = iff( isnull(AdditionalFields.["FROM.GROUP"]), AdditionalFields.["FROM.GROUP"], AdditionalFields.["FROM.GROUP"])
    | where GROUP_CHANGED <> ""
    | extend GROUP_REMOVED = iff( isnull(AdditionalFields.["TARGET_OBJECT.GROUP"]), AdditionalFields.["TARGET_OBJECT.GROUP"], AdditionalFields.["TARGET_OBJECT.GROUP"])
    | extend USER_REMOVED = iff( isnull(AdditionalFields.["TARGET_OBJECT.USER"]), AdditionalFields.["TARGET_OBJECT.USER"], AdditionalFields.["TARGET_OBJECT.USER"])
    | extend DEVICE_REMOVED = iff( isnull(AdditionalFields.["TARGET_OBJECT.DEVICE"]), AdditionalFields.["TARGET_OBJECT.DEVICE"], AdditionalFields.["TARGET_OBJECT.DEVICE"])
    | project Timestamp, ActionType, INITIATED_BY, GROUP_CHANGED, GROUP_REMOVED, USER_REMOVED, DEVICE_REMOVED,AdditionalFields
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: Matt Novitsch
    support:
        tier: Community
    categories:
        domains: [ "Security - Identity" ]