Privileged Account Password Changes

id: d9cccaf9-d15e-4731-a62a-06d76e9c5e67
name: Privileged Account Password Changes
description: |
  'Identifies where Privileged Accounts have updated passwords or security information. This is joined with UEBA alerts to filter to only those accounts with a high investigation priority.
  Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
  - connectorId: BehaviorAnalytics
    dataTypes:
      - IdentityInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1078.004
query: |
  let priority_threshold = 5;
  let admins = (IdentityInfo
  | where AssignedRoles contains "Admin" or GroupMembership has "Admin"
  | summarize by tolower(AccountUPN));
  AuditLogs
  | where Category =~ "UserManagement"
  | where OperationName has_any ("password", "security info")
  | extend AccountUPN = tolower(tostring(TargetResources[0].userPrincipalName))
  | where AccountUPN in (admins)
  | join kind=inner (BehaviorAnalytics | where InvestigationPriority > priority_threshold | where isnotempty(UserPrincipalName)| summarize by UserPrincipalName | extend AccountUPN = tolower(UserPrincipalName)) on AccountUPN
  | extend AccountCustomEntity = AccountUPN
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.1.0