Azure Activity Logs: Granting Role Assignments from New Source IPs

Alerts on Azure role assignment permission grants when they originate from a new source IP in Activity Logs.

FreeReviewedSigma · Medium · v5

Product: azure
Service: activitylogs
Author: sawwinnnaung (SigmaHQ), DRL 1.1
Published: 2020-05-07
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1098.003Additional Cloud Roles
Priv Esc
- T1098.003Additional Cloud Roles
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags instances where a user grants permissions by writing role assignments in Azure (Microsoft.Authorization/roleAssignments/write). It is designed to alert when the source IP for this permission-granting activity is previously unseen, which can indicate suspicious access patterns used to modify authorization. The detection relies on Azure activity log telemetry capturing the role assignment write event and the associated source IP information.

Reporting behind it

Related detections9 linkedT1098.003 — drag to rearrange

Suspicious Service Principal Creation via Azure Audit Logs

Malicious IAM Group Creation for SES Abuse by JavaGhost (via cloudtrail)

Malicious Administrator Policy Attachment for Privilege Escalation in AWS

Suspicious Azure Contributor Role Assignment to Identity

Malicious GCP Service Account Backdoor via serviceAccountTokenCreator Grant

Suspicious GCP Service Account Impersonation via GenerateAccessToken

Malicious Azure Elevate Access to User Access Administrator

Suspicious Azure Policy Definition or Assignment Modification

Suspicious AWS IAM Role Creation With Cross-Account Trust Policy

Azure Activity Logs: Granting Role Assignments from New Source IPs

Pivot detection · T1098.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-activity-logs-granting-role-permissions-via-roleassignments-write-from-new-a622fcd2

title: "Azure Activity Logs: Granting Role Assignments from New Source IPs"
id: 6856baf0-31a8-4653-9e25-a522fa315888
status: test
description: This rule flags instances where a user grants permissions by writing role assignments in Azure (Microsoft.Authorization/roleAssignments/write). It is designed to alert when the source IP for this permission-granting activity is previously unseen, which can indicate suspicious access patterns used to modify authorization. The detection relies on Azure activity log telemetry capturing the role assignment write event and the associated source IP information.
references:
  - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_granting_permission_detection.yml
author: sawwinnnaung, Huntrule Team
date: 2020-05-07
modified: 2023-10-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098.003
logsource:
  product: azure
  service: activitylogs
detection:
  keywords:
    - Microsoft.Authorization/roleAssignments/write
  condition: keywords
falsepositives:
  - Valid change
level: medium
license: DRL-1.1
related:
  - id: a622fcd2-4b5a-436a-b8a2-a4171161833c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL