AnalysisType: rule
Filename: crowdstrike_admin_role_assigned.py
RuleID: "Crowdstrike.AdminRoleAssigned"
DisplayName: "Crowdstrike Admin Role Assigned"
Enabled: true
LogTypes:
- Crowdstrike.EventStreams
Severity: Medium
Reports:
MITRE ATT&CK:
- TA0003:T1098.003 # Persistence: Additional Cloud Roles
- TA0004:T1098.003 # Priv Escalation: Additional Cloud Roles
Description: A user was assigned a priviledged role
DedupPeriodMinutes: 60
Threshold: 1
Runbook: Confirm the role assignment is justified.
Tests:
- Name: Admin Role Assigned (Single)
ExpectedResult: true
Log:
{
"event": {
"AuditKeyValues": [
{
"Key": "target_name",
"ValueString": "merry.brandybuck@hobbiton.co"
},
{
"Key": "target_user_uuid",
"ValueString": "e70e5306-4a83-4a9f-9b59-a78c304c438b"
},
{
"Key": "target_cid",
"ValueString": "fake_customer_id"
},
{
"Key": "roles",
"ValueString": "billing_dashboard_admin"
},
{
"Key": "actor_cid",
"ValueString": "fake_customer_id"
},
{
"Key": "trace_id",
"ValueString": "897d300ad09137b362ee6a62846a9277"
},
{
"Key": "actor_user",
"ValueString": "peregrin.took@hobbiton.co"
},
{
"Key": "actor_user_uuid",
"ValueString": "e70e5306-4a83-4a9f-9b59-a78c304c438b"
}
],
"OperationName": "grantUserRoles",
"ServiceName": "Crowdstrike Authentication",
"Success": true,
"UTCTimestamp": "2024-07-22 21:32:49.000000000",
"UserId": "peregrin.took@hobbiton.co",
"UserIp": "1.1.1.1"
},
"metadata": {
"customerIDString": "fake_customer_id",
"eventCreationTime": "2024-07-22 21:32:49.531000000",
"eventType": "AuthActivityAuditEvent",
"offset": 342905,
"version": "1.0"
}
}
- Name: Admin Role Assigned (Multiple)
ExpectedResult: true
Log:
{
"event": {
"AuditKeyValues": [
{
"Key": "target_name",
"ValueString": "merry.brandybuck@hobbiton.co"
},
{
"Key": "target_user_uuid",
"ValueString": "e70e5306-4a83-4a9f-9b59-a78c304c438b"
},
{
"Key": "target_cid",
"ValueString": "fake_customer_id"
},
{
"Key": "roles",
"ValueString": "custom_non_admin_role,billing_dashboard_admin,falconhost_admin"
},
{
"Key": "actor_cid",
"ValueString": "fake_customer_id"
},
{
"Key": "trace_id",
"ValueString": "897d300ad09137b362ee6a62846a9277"
},
{
"Key": "actor_user",
"ValueString": "peregrin.took@hobbiton.co"
},
{
"Key": "actor_user_uuid",
"ValueString": "e70e5306-4a83-4a9f-9b59-a78c304c438b"
}
],
"OperationName": "grantUserRoles",
"ServiceName": "Crowdstrike Authentication",
"Success": true,
"UTCTimestamp": "2024-07-22 21:32:49.000000000",
"UserId": "peregrin.took@hobbiton.co",
"UserIp": "1.1.1.1"
},
"metadata": {
"customerIDString": "fake_customer_id",
"eventCreationTime": "2024-07-22 21:32:49.531000000",
"eventType": "AuthActivityAuditEvent",
"offset": 342905,
"version": "1.0"
}
}
- Name: Non-Admin Role Assigned
ExpectedResult: false
Log:
{
"event": {
"AuditKeyValues": [
{
"Key": "target_name",
"ValueString": "merry.brandybuck@hobbiton.co"
},
{
"Key": "target_user_uuid",
"ValueString": "e70e5306-4a83-4a9f-9b59-a78c304c438b"
},
{
"Key": "target_cid",
"ValueString": "fake_customer_id"
},
{
"Key": "roles",
"ValueString": "custom_non_admin_role"
},
{
"Key": "actor_cid",
"ValueString": "fake_customer_id"
},
{
"Key": "trace_id",
"ValueString": "897d300ad09137b362ee6a62846a9277"
},
{
"Key": "actor_user",
"ValueString": "peregrin.took@hobbiton.co"
},
{
"Key": "actor_user_uuid",
"ValueString": "e70e5306-4a83-4a9f-9b59-a78c304c438b"
}
],
"OperationName": "grantUserRoles",
"ServiceName": "Crowdstrike Authentication",
"Success": true,
"UTCTimestamp": "2024-07-22 21:32:49.000000000",
"UserId": "peregrin.took@hobbiton.co",
"UserIp": "1.1.1.1"
},
"metadata": {
"customerIDString": "fake_customer_id",
"eventCreationTime": "2024-07-22 21:32:49.531000000",
"eventType": "AuthActivityAuditEvent",
"offset": 342905,
"version": "1.0"
}
}
# ------ paired body: crowdstrike_admin_role_assigned.py ------
from panther_crowdstrike_event_streams_helpers import audit_keys_dict, cs_alert_context
# List of priviledged roles.
# IMPORTANT: YOU MUST ADD ANY CUSTOM ADMIN ROLES YOURSELF
ADMIN_ROLES = {
"billing_dashboard_admin",
"falconhost_admin",
"firewall_manager",
"xdr_admin", # NG SIEM Admin
"remote_responder_three", # Remote Responder Admin
}
def get_roles_assigned(event):
"""Returns a list of the roles assigned in this event."""
# Extract the AuditKeyValues construct
audit_keys = audit_keys_dict(event)
# Return Roles
return audit_keys.get("roles", "").split(",")
def rule(event):
# Ignore non role-granting events
if not all(
[
event.deep_get("event", "OperationName") == "grantUserRoles",
event.deep_get("event", "Success"),
]
):
return False
# Raise alert if any of the admin roles were assigned
roles_assigned = get_roles_assigned(event)
return bool(ADMIN_ROLES & set(roles_assigned))
def title(event):
audit_keys = audit_keys_dict(event)
actor = audit_keys["actor_user"]
target = audit_keys["target_name"]
admin_roles = set(get_roles_assigned(event)) & ADMIN_ROLES
return f"{actor} assigned admin roles to {target}: {', '.join(list(admin_roles))}"
def dedup(event):
# The title includes the role names, but if the actor assigned more roles to the user, we
# dedup those alerts as well.
audit_keys = audit_keys_dict(event)
actor = audit_keys["actor_user"]
target = audit_keys["target_name"]
return f"{actor}-{target}"
def alert_context(event):
context = cs_alert_context(event)
actor = context.get("actor_user", "UNKNOWN_ACTOR")
target = context.get("target_name", "UNKNOWN_TARGET")
context["actor_target"] = f"{actor}-{target}"
return context