You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| stats count min(_time) as firstTime max(_time) as lastTime values(displayName) as displayName values(src_ip) as src_ip values(eval(mvfilter(oldValue!="null"))) as oldValue by src_user, object, newValue
search: '`wineventlog_security` (EventCode=4720) OR (EventCode=4732 Group_Name=Administrators)
14
+
| stats dc(EventCode) as evCount min(_time) as _time range(_time) as duration values(src_user) as src_user values(src_user_category) as src_user_category values(dest_category) as dest_category by user dest
15
+
| where evCount=2
16
+
| fields - evCount, duration
17
+
| `detect_new_local_admin_account_filter`'
17
18
how_to_implement: You must be ingesting Windows event logs using the Splunk Windows
18
19
TA and collecting event code 4720 and 4732
19
20
known_false_positives: The activity may be legitimate. For this reason, it's best
| stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName
| stats min(_time) as _time values(displayName) as gp_name, values(gPCFileSysPath) as gPCFileSysPath, values(src_user) as src_user, values(dest) as dest, values(dest_category) as dest_category, values(src_user_category) as src_user_category by displayName
"""Application Administrator""","True","Can create and manage all aspects of app registrations and enterprise apps."
3
+
"""Application Developer""","True","Can create application registrations independent of the 'Users can register applications' setting."
2
4
"""Authentication Administrator""","True","Can access to view, set and reset authentication method information for any non-admin user."
3
-
"""Authentication Policy Administrator""","True","Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials."
4
-
"""Azure AD Joined Device Local Administrator""","True","Users assigned to this role are added to the local administrators group on Azure AD-joined devices."
5
-
"""Azure DevOps Administrator""","True","Can manage Azure DevOps policies and settings."
6
-
"""Azure Information Protection Administrator""","True","Can manage all aspects of the Azure Information Protection product."
5
+
"""Authentication Extensibility Administrator""","True","Customize sign in and sign up experiences for users by creating and managing custom authentication extensions."
6
+
"""B2C IEF Keyset Administrator""","True","Can manage secrets for federation and encryption in the Identity Experience Framework (IEF)."
7
7
"""Cloud Application Administrator""","True","Can create and manage all aspects of app registrations and enterprise apps except App Proxy."
8
-
"""Cloud Device Administrator""","True","Limited access to manage devices in Azure AD."
9
-
"""Compliance Administrator""","True","Can read and manage compliance configuration and reports in Azure AD and Microsoft 365."
8
+
"""Cloud Device Administrator""","True","Limited access to manage devices in Microsoft Entra ID."
"""Exchange Administrator""","True","Can manage all aspects of the Exchange product."
10
+
"""Directory Synchronization Accounts""","True","Only used by Microsoft Entra Connect and Microsoft Entra Cloud Sync services."
11
+
"""Directory Writers""","True","Can read and write basic directory information. For granting access to applications, not intended for users."
12
+
"""Domain Name Administrator""","True","Can manage domain names in cloud and on-premises."
12
13
"""External Identity Provider Administrator""","True","Can configure identity providers for use in direct federation."
13
-
"""Groups Administrator""","True","Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports."
14
+
"""Global Administrator""","True","Can manage all aspects of Microsoft Entra ID and Microsoft services that use Microsoft Entra identities."
15
+
"""Global Reader""","True","Can read everything that a Global Administrator can, but not update anything."
14
16
"""Helpdesk Administrator""","True","Can reset passwords for non-administrators and Helpdesk Administrators."
15
-
"""Hybrid Identity Administrator""","True","Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings."
17
+
"""Hybrid Identity Administrator""","True","Manage Active Directory to Microsoft Entra cloud provisioning, Microsoft Entra Connect, pass-through authentication (PTA), password hash synchronization (PHS), seamless single sign-on (seamless SSO), and federation settings. Does not have access to manage Microsoft Entra Connect Health."
16
18
"""Intune Administrator""","True","Can manage all aspects of the Intune product."
17
-
"""License Administrator""","True","Can manage product licenses on users and groups."
18
-
"""Network Administrator""","True","Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications."
19
+
"""Lifecycle Workflows Administrator""","True","Create and manage all aspects of workflows and tasks associated with Lifecycle Workflows in Microsoft Entra ID."
20
+
"""Partner Tier1 Support""","True","Do not use - not intended for general use."
21
+
"""Partner Tier2 Support""","True","Do not use - not intended for general use."
19
22
"""Password Administrator""","True","Can reset passwords for non-administrators and Password Administrators."
20
-
"""Privileged Role Administrator""","True","Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management."
21
-
"""Security Administrator""","True","Can read security information and reports, and manage configuration in Azure AD and Office 365."
22
-
"""SharePoint Administrator""","True","Can manage all aspects of the SharePoint service."
23
-
"""Teams Administrator""","True","Can manage the Microsoft Teams service."
24
-
"""User Administrator""","True","Can manage all aspects of users and groups, including resetting passwords for limited admins."
25
-
"""Windows 365 Administrator""","True","Can provision and manage all aspects of Cloud PCs."
26
-
23
+
"""Privileged Authentication Administrator""","True","Can access to view, set and reset authentication method information for any user (admin or non-admin)."
24
+
"""Privileged Role Administrator""","True","Can manage role assignments in Microsoft Entra ID, and all aspects of Privileged Identity Management."
25
+
"""Security Administrator""","True","Can read security information and reports, and manage configuration in Microsoft Entra ID and Office 365."
26
+
"""Security Operator""","True","Creates and manages security events."
27
+
"""Security Reader""","True","Can read security information and reports in Microsoft Entra ID and Office 365."
28
+
"""User Administrator""","True","Can manage all aspects of users and groups, including resetting passwords for limited admins."
0 commit comments