Dylan Evans
@decksyCompletionist
13 followers74 downloads294 copies46 likes3,043 views
15 detections
Filters
Last updated
All Time
Detection languages
15
Categories
5
4
3
3
3
Platforms
11
4
4
3
1
Products / Services
11
4
4
2
2
MITRE Techniques
5
5
4
4
4
This rule detects when a user is added to an administrative or management role in Azure Active Directory outside of defined business hours. It specifically looks for 'Add member to role completed' or 'Add app role assignment grant to user' operations where the target role contains 'admin' or 'Manage', and the event occurs outside of the configured business hours (7 AM to 6 PM local time, Monday to Friday).
KQL Query
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query
KQL Query
Page 2 of 2