RB-ANALYSIS-009: Privileged Access Assessment
Document Control
| Attribute | Value | Date |
|---|---|---|
| Document Name | Privileged Access Assessment | |
| Version | [Enter version number] | [Enter date] |
| Owner | [Enter owner/team] | [Enter date] |
| Status | [Draft/Approved/Retired] | [Enter date] |
| Next Review Date | [Enter next review date] | [Enter date] |
| Approvals | [Enter approver(s)] | [Enter date] |
| Change Summary | Initial creation | [Enter date] |
1. Prerequisites
- Authentication logs
- Administrative activity logs
- Role assignment telemetry
- Endpoint telemetry
- Session activity logs
- Identity provider access
- SIEM platform access
- PAM platform access
- EDR platform access
- Cloud audit logs access
2. Step-by-Step Instructions
- Identify Privileged Access Exposure
- Determine:
- Administrative roles assigned
- Active privileged sessions
- Privileged application access
- Shared administrative accounts
- Common Failure Modes:
- Failing to review inherited privilege
- Ignoring service account exposure
- Determine:
- Review Administrative Activity
- Assess:
- Role assignment changes
- Policy modifications
- Access control changes
- Security configuration changes
- Administrative API activity
- Assess:
- Identify Privilege Escalation Indicators
- Look for:
- New privileged accounts
- Group membership changes
- Conditional access modifications
- MFA policy changes
- Service principal abuse
- Look for:
- Review Lateral Movement Activity
- Identify:
- Remote administrative access
- Cross-system authentication
- Privileged session hopping
- Administrative tool usage
- Identify:
3. Post-Action
- Document all findings within the incident ticket
Contributor
Vishal Thakur GitHub: https://github.com/malienist
Jayden Vo GitHub: https://github.com/jayden-vo
Contributed to the Arcana Incident Response Documentation Framework.