Azure Activity Logs: Granting Role Permissions via roleAssignments/write from New Source IP

Alerts on Azure role assignment permission grants when they originate from a new source IP in Activity Logs.

FreeUnreviewedSigmamediumv1

azure-activity-logs-granting-role-permissions-via-roleassignments-write-from-new-a622fcd2

title: "Azure Activity Logs: Granting Role Permissions via roleAssignments/write from New Source IP"
id: 6856baf0-31a8-4653-9e25-a522fa315888
status: test
description: This rule flags Azure activity log events where role assignments are granted by writing to Microsoft.Authorization/roleAssignments/write. It helps identify situations where an attacker or user grants permissions to another account, potentially enabling privilege escalation or persistence. The detection relies on Azure Activity Logs events containing this role assignment write action and triggers an alert when the source IP is previously unseen.
references:
  - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_granting_permission_detection.yml
author: sawwinnnaung, Huntrule Team
date: 2020-05-07
modified: 2023-10-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098.003
logsource:
  product: azure
  service: activitylogs
detection:
  keywords:
    - Microsoft.Authorization/roleAssignments/write
  condition: keywords
falsepositives:
  - Valid change
level: medium
license: DRL-1.1
related:
  - id: a622fcd2-4b5a-436a-b8a2-a4171161833c
    type: derived

What it detects

This rule flags Azure activity log events where role assignments are granted by writing to Microsoft.Authorization/roleAssignments/write. It helps identify situations where an attacker or user grants permissions to another account, potentially enabling privilege escalation or persistence. The detection relies on Azure Activity Logs events containing this role assignment write action and triggers an alert when the source IP is previously unseen.

Known false positives

Valid change

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.