AN0899
Analytic 0899
Identity Provider
Adversaries create user accounts via identity provider APIs or admin portals (e.g., Azure AD, Okta). These accounts may be assigned elevated privileges or used in chained authentication. Detection monitors Add User activity from suspicious IPs or automation sources, followed by role/permission escalation.
azure:audit
Add user
azure:audit
Add member to role
azure:signinlogs
Login from newly created account
[IPAddress]
Filter on IPs outside known admin networks or geographies
[RoleThreshold]
Raise alert if total admins exceeds historical baseline
[ServicePrincipalFlag]
Differentiate between user and service principal creation
AN0900
Analytic 0900
IaaS
Adversaries use cloud API, CLI, or console to create IAM users or roles. Initial CreateUser is followed by policy/role attachment. Detection monitors temporal chains involving IAM:CreateUser, AttachUserPolicy, and credential generation, especially from automation or foreign IP ranges.
AWS:CloudTrail
CreateUser
AWS:CloudTrail
AttachUserPolicy
[Region]
Alert when creation happens in unexpected regions
[TimeWindow]
Chain CreateUser → AttachPolicy → AccessKey within short timeframe
[UserAgent]
Monitor API calls from non-console or automation tools
AN0901
Analytic 0901
SaaS
Adversaries create SaaS accounts via admin dashboards or integrations (e.g., Zoom, Salesforce, Slack). Monitor lifecycle.create or account provisioning events from non-standard sources or times.
saas:zoom
New user created
[ApplicationScope]
Trigger only for high-privilege or sensitive applications
[AdminUserList]
Compare actor to list of approved SaaS administrators
AN0902
Analytic 0902
Office Suite
Adversaries leverage M365 or Google Workspace APIs to create users, service accounts, or guest accounts. Follow-on behaviors include login activity, role escalation, or service principal token generation.
m365:unified
Add user
m365:unified
Add member to group
[GroupSensitivity]
Only alert on additions to high-value groups (e.g., Domain Admins)
[GuestFlag]
Tune alerts based on guest vs internal user creation