Azure AD Audit Logs: Temporary Access Pass Added to an Account

Flags admin registration of a temporary access pass method in Azure audit logs for user accounts.

FreeUnreviewedSigmahighv1

azure-ad-audit-logs-temporary-access-pass-added-to-an-account-fa84aaf5

title: "Azure AD Audit Logs: Temporary Access Pass Added to an Account"
id: 1d339b38-0150-49f8-9a32-1843e21c0ed7
status: test
description: This rule flags events in Azure audit logs where an administrator registers a temporary access pass (TAP) method for a user account. Attackers can use TAPs to establish short-lived but effective access, potentially enabling privilege escalation or persistence depending on the target account. The detection relies on audit log message text indicating the registration of a temporary access pass method.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_tap_added.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-08-10
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Admin registered security info
    Status: Admin registered temporary access pass method for user
  condition: selection
falsepositives:
  - Administrator adding a legitimate temporary access pass
level: high
license: DRL-1.1
related:
  - id: fa84aaf5-8142-43cd-9ec2-78cfebf878ce
    type: derived

What it detects

This rule flags events in Azure audit logs where an administrator registers a temporary access pass (TAP) method for a user account. Attackers can use TAPs to establish short-lived but effective access, potentially enabling privilege escalation or persistence depending on the target account. The detection relies on audit log message text indicating the registration of a temporary access pass method.

Known false positives

Administrator adding a legitimate temporary access pass

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.