Azure AD Audit Logs: User Added to Global or Device Administrator Roles

title: "Azure AD Audit Logs: User Added to Global or Device Administrator Roles"
id: 48853aa1-81db-44d3-b7bf-2f868ee11dfc
status: test
description: This rule flags events in Azure AD audit logs where a user is added as a member to Global Administrator or Device Administrator roles. Adding privileged role membership is a common persistence and privilege-escalation step because it grants broad administrative capabilities. It relies on audit log fields that indicate the role-management category, the add/member-to-role operation text, and target role identifiers for the two administrator roles.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-administrator-roles
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_users_added_to_device_admin_roles.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
tags:
  - attack.persistence
  - attack.initial-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    Category: RoleManagement
    OperationName|contains|all:
      - Add
      - member to role
    TargetResources|contains:
      - 7698a772-787b-4ac8-901f-60d6b08affd2
      - 62e90394-69f5-4237-9190-012177145e10
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 11c767ae-500b-423b-bae3-b234450736ed
    type: derived