Entra ID group adds in the last 7 days

Description

This query looks for Entra ID group adds identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.

Query · kql

let LookBack = 7d; CloudAppEvents | where ActionType in ("Add member to group.") and AccountType == "Regular" and Timestamp > ago(LookBack) | extend SecondElement = RawEventData.ModifiedProperties[1] | extend UserAddedId = RawEventData.ObjectId | extend GroupName = SecondElement.NewValue | project Timestamp, ActionType,UserAddedId,PerformedBy = AccountDisplayName,GroupName
Raw source Entra ID group adds in the last 7 days · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f5e4d3c2-b1a0-4f9d-8e7c-6b5a4d3e2c1f
name: Entra ID group adds in the last 7 days
description: |
  This query looks for Entra ID group adds identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.
requiredDataConnectors: 
  - connectorId: MicrosoftThreatProtection
    dataTypes: 
      - CloudAppEvents
tactics: 
- Privilege Escalation
relevantTechniques:
- T1548
query: >
  let LookBack = 7d;
  CloudAppEvents
  | where ActionType in ("Add member to group.") and AccountType == "Regular" and Timestamp > ago(LookBack)
  | extend SecondElement = RawEventData.ModifiedProperties[1]
  | extend UserAddedId = RawEventData.ObjectId
  | extend GroupName = SecondElement.NewValue
  | project Timestamp, ActionType,UserAddedId,PerformedBy = AccountDisplayName,GroupName
entityMappings: 
  - entityType: Account
    fieldMappings: 
      - identifier: DisplayName
        columnName: UserAddedId
      - identifier: DisplayName
        columnName: PerformedBy
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.