Azure AD audit logs: Failed guest invitation by non-authorized inviter

Identifies failed guest user invitations in Azure audit logs when the inviter lacks required permissions.

FreeUnreviewedSigmamediumv1

azure-ad-audit-logs-failed-guest-invitation-by-non-authorized-inviter-0b4b72e3

title: "Azure AD audit logs: Failed guest invitation by non-authorized inviter"
id: 197d889d-d287-430d-bfa1-50c56d5b2d61
status: test
description: This rule flags cases where an “Invite external user” action fails because the inviter lacks permission to invite guest users. Attackers may probe or attempt unauthorized guest access as part of initial access or privilege escalation. It relies on Azure audit log events that include the invitation message and a failure status for the attempted action.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#things-to-monitor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_guest_invite_failure.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-08-10
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Invite external user
    Status: failure
  condition: selection
falsepositives:
  - A non malicious user is unaware of the proper process
level: medium
license: DRL-1.1
related:
  - id: 0b4b72e3-4c53-4d5b-b198-2c58cfef39a9
    type: derived

What it detects

This rule flags cases where an “Invite external user” action fails because the inviter lacks permission to invite guest users. Attackers may probe or attempt unauthorized guest access as part of initial access or privilege escalation. It relies on Azure audit log events that include the invitation message and a failure status for the attempted action.

Known false positives

A non malicious user is unaware of the proper process

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.