Changes To Azure Lighthouse Delegation
Query
AzureActivity
| where OperationNameValue =~ "Microsoft.ManagedServices/registrationAssignments/Write"
| summarize ActivityStatusValue=make_list(ActivityStatusValue), timestamp = max(TimeGenerated) by IPCustomEntity=CallerIpAddress, AccountCustomEntity=Caller, SubscriptionId, OperationNameValue, CorrelationIdExplanation
This query is used to identify when Azure Lighthouse is used to delegate resources for access through another Azure Active Directory tenant. It looks for a specific operation name related to registration assignments and summarizes the activity status and timestamp for each unique combination of caller IP address, caller account, subscription ID, operation name, and correlation ID. The query is scheduled to run once a day and has a medium severity level. It is relevant to the persistence tactic and the T1136 technique. The query also includes entity mappings for the Account and IP entities.