Azure Audit Logs: Bulk Removal of Privileged Role Members

Flags Azure audit log events indicating bulk removal of eligible members from privileged roles.

FreeUnreviewedSigmahighv1

azure-audit-logs-bulk-removal-of-privileged-role-members-102e11e3

title: "Azure Audit Logs: Bulk Removal of Privileged Role Members"
id: ac63aceb-e596-4027-ae66-a772a9d31c02
status: test
description: This rule identifies audit events where eligible privileged role members are removed, matching “Remove eligible member (permanent)” and “Remove eligible member (eligible)”. Removing members from privileged roles can be part of account manipulation, reducing an administrator’s access or preparing subsequent actions. It relies on Azure audit log message fields that record these permission change events.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-08-05
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
      - Remove eligible member (permanent)
      - Remove eligible member (eligible)
  condition: selection
falsepositives:
  - Legtimate administrator actions of removing members from a role
level: high
license: DRL-1.1
related:
  - id: 102e11e3-2db5-4c9e-bc26-357d42585d21
    type: derived

What it detects

This rule identifies audit events where eligible privileged role members are removed, matching “Remove eligible member (permanent)” and “Remove eligible member (eligible)”. Removing members from privileged roles can be part of account manipulation, reducing an administrator’s access or preparing subsequent actions. It relies on Azure audit log message fields that record these permission change events.

Known false positives

Legtimate administrator actions of removing members from a role

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.