Azure Activity Logs: Permission Elevation to Manage All Subscriptions

Alerts on Azure Activity Log authorization elevation actions that can grant access to manage all subscriptions.

FreeUnreviewedSigmahighv1

azure-activity-logs-permission-elevation-to-manage-all-subscriptions-09438caa

title: "Azure Activity Logs: Permission Elevation to Manage All Subscriptions"
id: a9d6facf-963d-444f-92f2-331c69977350
status: test
description: This rule flags Azure Activity Log events where an authorization elevation action occurs, specifically operationName MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION. Elevating permissions to manage all Azure subscriptions can enable an attacker to access or control subscriptions across the environment. Investigate promptly when elevation is not explicitly planned, relying on Azure Activity Logs telemetry that records the operationName associated with the authorization change.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_subscription_permissions_elevation_via_activitylogs.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-26
modified: 2022-08-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION
  condition: selection
falsepositives:
  - If this was approved by System Administrator.
level: high
license: DRL-1.1
related:
  - id: 09438caa-07b1-4870-8405-1dbafe3dad95
    type: derived

What it detects

This rule flags Azure Activity Log events where an authorization elevation action occurs, specifically operationName MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION. Elevating permissions to manage all Azure subscriptions can enable an attacker to access or control subscriptions across the environment. Investigate promptly when elevation is not explicitly planned, relying on Azure Activity Logs telemetry that records the operationName associated with the authorization change.

Known false positives

If this was approved by System Administrator.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.