cloudflare/Azure-Sentinel

// Name: Granting permissions to account
//
// Id: 2b6a3882-d601-4298-983b-880f6dc7acdb
//
// Description: shows the most prevalent users who grant access to others on azure resources and for each account 
// their common source ip address. If an operation is not from this IP address it may be worthy of investigation.
//
// DataSource: #AzureActivity
//
// Tactics: #Persistence, #LateralMovement
//
AzureActivity
| where TimeGenerated >= ago(14d)
| where OperationName == "Create role assignment"
| where ActivityStatus == "Succeeded" 
| project EventSubmissionTimestamp, Caller, CallerIpAddress, SubscriptionId, ResourceId 
| project Caller, CallerIpAddress
| extend AccountCustomEntity = Caller
| extend IPCustomEntity = CallerIpAddress
| evaluate basket()