diff --git a/rules/cloud/azure/azure_privileged_account_creation.yml b/rules/cloud/azure/azure_privileged_account_creation.yml index f417e2832..f93dbd842 100644 --- a/rules/cloud/azure/azure_privileged_account_creation.yml +++ b/rules/cloud/azure/azure_privileged_account_creation.yml @@ -2,8 +2,9 @@ title: Privileged Account Creation id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947 status: experimental description: Detects when a new admin is created. -author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' +author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton date: 2022/08/11 +modified: 2022/08/16 references: - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts logsource: @@ -14,7 +15,7 @@ detection: properties.message|contains|all: - Add user - Add member to role - Status: Sucess + Status: Success condition: selection falsepositives: - A legitmate new admin account being created