Admin Role Assigned


Description

Assigning an admin role manually could be a sign of privilege escalation

Query · python

import panther_event_type_helpers as event_type


def rule(event):
    # filter events on unified data model field
    return event.udm("event_type") == event_type.ADMIN_ROLE_ASSIGNED


def title(event):
    # use unified data model field in title
    recipient = event.udm("user") or event.get("team") or "USER_OR_TEAM_NOT_FOUND"
    return (
        f"{event.get('p_log_type')}: [{event.udm('actor_user')}] assigned admin privileges "
        f"[{event.udm('assigned_admin_role')}] to [{recipient}]"
    )


def alert_context(event):
    return {
        "ips": event.get("p_any_ip_addresses", []),
        "actor": event.udm("actor_user"),
        "user": event.udm("user"),
    }

Analyst notes

Verify with the user who attached the role or add to a allowlist

Raw source Admin Role Assigned · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified.
AnalysisType: rule
Filename: admin_assigned.py
RuleID: "Standard.AdminRoleAssigned"
DisplayName: "Admin Role Assigned"
Enabled: true
LogTypes:
  - Asana.Audit
  - Atlassian.Audit
  - GCP.AuditLog
  - GitHub.Audit
  - GSuite.ActivityEvent
  - OneLogin.Events
  - Zendesk.Audit
Tags:
  - DataModel
  - Privilege Escalation:Valid Accounts
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0004:T1078
Description: Assigning an admin role manually could be a sign of privilege escalation
Runbook: Verify with the user who attached the role or add to a allowlist
Reference: https://medium.com/@gokulelango1040/privilege-escalation-attacks-28a9ef226abb
SummaryAttributes:
  - p_any_ip_addresses
Tests:
  - Name: GCP - Admin Assigned
    ExpectedResult: true
    Log:
      {
        "protoPayload":
          {
            "at_sign_type": "type.googleapis.com/google.cloud.audit.AuditLog",
            "serviceName": "cloudresourcemanager.googleapis.com",
            "methodName": "SetIamPolicy",
            "authenticationInfo": { "principalEmail": "bob@example.com" },
            "requestMetadata": { "callerIP": "4.4.4.4" },
            "serviceData":
              {
                "@type": "type.googleapis.com/google.iam.v1.logging.AuditData",
                "policyDelta":
                  {
                    "bindingDeltas":
                      [
                        {
                          "action": "ADD",
                          "member": "cat@example.com",
                          "role": "roles/resourcemanager.organizationAdmin",
                        },
                      ],
                  },
              },
          },
        "p_log_type": "GCP.AuditLog",
      }
  - Name: GCP - Multiple Admin Roles Assigned
    ExpectedResult: true
    Log:
      {
        "protoPayload":
          {
            "at_sign_type": "type.googleapis.com/google.cloud.audit.AuditLog",
            "serviceName": "cloudresourcemanager.googleapis.com",
            "methodName": "SetIamPolicy",
            "authenticationInfo": { "principalEmail": "bob@example.com" },
            "requestMetadata": { "callerIP": "4.4.4.4" },
            "serviceData":
              {
                "@type": "type.googleapis.com/google.iam.v1.logging.AuditData",
                "policyDelta":
                  {
                    "bindingDeltas":
                      [
                        {
                          "action": "ADD",
                          "member": "cat@example.com",
                          "role": "roles/resourcemanager.organizationAdmin",
                        },
                        {
                          "action": "ADD",
                          "member": "dog@example.com",
                          "role": "roles/owner",
                        },
                      ],
                  },
              },
          },
        "p_log_type": "GCP.AuditLog",
      }
  - Name: GSuite - Other Admin Action
    ExpectedResult: false
    Log:
      {
        "actor": { "email": "bobert@example.com" },
        "id": { "applicationName": "admin" },
        "type": "DELEGATED_ADMIN_SETTINGS",
        "name": "RENAME_ROLE",
        "p_log_type": "GSuite.ActivityEvent",
      }
  - Name: GSuite - Privileges Assigned
    ExpectedResult: true
    Log:
      {
        "actor": { "email": "bobert@example.com" },
        "id": { "applicationName": "admin" },
        "type": "DELEGATED_ADMIN_SETTINGS",
        "name": "ASSIGN_ROLE",
        "parameters":
          {
            "ROLE_NAME": "Some Admin Role",
            "USER_EMAIL": "bob@example.com",
          },
        "p_log_type": "GSuite.ActivityEvent",
      }
  - Name: OneLogin - Non permissions assigned event
    ExpectedResult: false
    Log: { "event_type_id": 8, "p_log_type": "OneLogin.Events" }
  - Name: OneLogin - Non super user permissions assigned
    ExpectedResult: false
    Log:
      {
        "event_type_id": 72,
        "privilege_name": "Manage users",
        "p_log_type": "OneLogin.Events",
      }
  - Name: OneLogin - Super user permissions assigned
    ExpectedResult: true
    Log:
      {
        "event_type_id": 72,
        "privilege_name": "Super user",
        "user_name": "Evil Bob",
        "actor_user_name": "Bobert O'Bobly",
        "p_log_type": "OneLogin.Events",
      }
  - Name: Github - User Promoted
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "team.promote_maintainer",
        "p_log_type": "GitHub.Audit",
        "user": "bob",
      }
  - Name: Github - Admin Added
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "business.add_admin",
        "p_log_type": "GitHub.Audit",
        "user": "bob",
      }
  - Name: Github - Admin Invited
    ExpectedResult: true
    Log:
      {
        "actor": "cat",
        "action": "business.invite_admin",
        "p_log_type": "GitHub.Audit",
        "user": "bob",
      }
  - Name: Github - Unknown Admin Role
    ExpectedResult: false
    Log:
      {
        "actor": "cat",
        "action": "unknown.admin_role",
        "p_log_type": "GitHub.Audit",
        "user": "bob",
      }
  - Name: Zendesk - Admin Role Downgraded
    ExpectedResult: false
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "source_id": 123,
        "source_type": "user",
        "source_label": "Bob Cat",
        "action": "update",
        "change_description": "Role changed from Administrator to End User",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - Admin Role Assigned
    ExpectedResult: true
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "source_id": 123,
        "source_type": "user",
        "source_label": "Bob Cat",
        "action": "update",
        "change_description": "Role changed from End User to Administrator",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - App Admin Role Assigned
    ExpectedResult: true
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "source_id": 123,
        "source_type": "user",
        "source_label": "Bob Cat",
        "action": "update",
        "change_description": "Explore role changed from not set to Admin\nGuide role changed from not set to Admin\nSupport role changed from not set to Admin\nTalk role changed from not set to Admin",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Asana - Normal Login
    ExpectedResult: false
    Log:
      {
        "actor":
          {
            "actor_type": "user",
            "email": "homer@springfield.com",
            "gid": "2222222",
            "name": "Homer",
          },
        "context": { "client_ip_address": "8.8.8.8", "context_type": "web" },
        "created_at": "2021-10-21T23:38:10.364Z",
        "details": { "method": ["ONE_TIME_KEY"] },
        "event_category": "logins",
        "event_type": "user_login_succeeded",
        "gid": "222222222",
        "resource":
          {
            "email": "homer@springfield.com",
            "gid": "2222222",
            "name": "homer",
            "resource_type": "user",
          },
        "p_log_type": "Asana.Audit",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }

  - Name: Asana - Admin Added
    ExpectedResult: True
    Log:
      {
        "actor": { "actor_type": "user", "name": Homer },
        "context": { "client_ip_address": "1.1.1.1", "context_type": "web" },
        "created_at": "2021-10-21T23:38:18.319Z",
        "details":
          {
            "group":
              {
                "gid": "11111",
                "name": "1183399881404774.2lgxga.asanatest1.us",
                "resource_type": "workspace",
              },
            "new_value": "member",
            "old_value": "super_admin",
          },
        "event_category": "roles",
        "event_type": "user_workspace_admin_role_changed",
        "gid": "22222",
        "resource":
          {
            "email": "marge@springfield.com",
            "gid": "222222",
            "name": "Marge Simpson",
            "resource_type": "user",
          },
        "p_log_type": "Asana.Audit",
      }


# ------ paired body: admin_assigned.py ------

import panther_event_type_helpers as event_type


def rule(event):
    # filter events on unified data model field
    return event.udm("event_type") == event_type.ADMIN_ROLE_ASSIGNED


def title(event):
    # use unified data model field in title
    recipient = event.udm("user") or event.get("team") or "USER_OR_TEAM_NOT_FOUND"
    return (
        f"{event.get('p_log_type')}: [{event.udm('actor_user')}] assigned admin privileges "
        f"[{event.udm('assigned_admin_role')}] to [{recipient}]"
    )


def alert_context(event):
    return {
        "ips": event.get("p_any_ip_addresses", []),
        "actor": event.udm("actor_user"),
        "user": event.udm("user"),
    }

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.