OwnerAddedToHighPrivilegedApplication.yaml

id: b6d4f7fe-2f5b-45e8-8f3d-b259ebe4100a
name: Owner added to high privileged application
version: 1.0.1
kind: Scheduled
description: An owner was added to application holding high privileged API permissions
severity: Medium
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
query: |-
  AuditLogs
  | where OperationName == "Add owner to application"
  | extend SearchKey = tostring(TargetResources[1].id)
  | join kind=inner _GetWatchlist('HighRiskApps') on SearchKey
  | extend TargetUser = tostring(TargetResources[0].userPrincipalName)
  | extend Actor = tostring(InitiatedBy.user.userPrincipalName)
  | extend TargetResourcesName = iff(isnotempty(TargetResources[0].displayName),TargetResources[0].displayName,TargetResources[0].id)
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    groupByCustomDetails: []
    groupByEntities: []
    groupByAlertDetails: []
    lookbackDuration: 5h
    enabled: false
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  TargetApp: TargetResourcesName
entityMappings:
  - entityType: Account
    fieldMappings:
      - columnName: TargetUser
        identifier: FullName
  - entityType: Account
    fieldMappings:
      - columnName: Actor
        identifier: FullName
suppressionDuration: 5h