Monitoring restricted management administrative units abuse.kql

SlimKQL · Sep 21, 2024 · 0bafb16 · 0bafb16
1 parent e54140d
commit 0bafb16
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/Sentinel/Monitoring restricted management administrative units abuse.kql b/Sentinel/Monitoring restricted management administrative units abuse.kql
@@ -8,13 +8,14 @@
 
 AuditLogs
 | where TimeGenerated > (1h)
-| where OperationName == "Add administrative unit"
-| where parse_json(tostring(TargetResources[0].modifiedProperties))[2].displayName == "IsMemberManagementRestricted"
-| where parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[2].newValue))[0] == true
+| where (OperationName == "Add administrative unit" and 
+parse_json(tostring(TargetResources[0].modifiedProperties))[2].displayName == "IsMemberManagementRestricted" and
+parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[2].newValue))[0] == true) or
+OperationName == "Add member to restricted management administrative unit"
 | extend RestrictedAUs = TargetResources[0].displayName
 | extend UPN = parse_json(tostring(InitiatedBy.user)).userPrincipalName
 | extend IPAddress = parse_json(tostring(InitiatedBy.user)).ipAddress
-| project TimeGenerated, RestrictedAUs, UPN, IPAddress, AdditionalDetails
+| project TimeGenerated, OperationName, RestrictedAUs, UPN, IPAddress, AdditionalDetails
 
 // MITRE ATT&CK Technique Mapping