Azure Audit Logs: Removal of Privileged Role Eligible Members

Flags Azure audit log events indicating bulk removal of eligible members from privileged roles.

FreeReviewedSigma · High · v5

Product: azure
Service: auditlogs
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' (SigmaHQ), DRL 1.1
Published: 2022-08-05
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1098Account Manipulation
Priv Esc
- T1098Account Manipulation
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags audit log events where a user is removed from a privileged role as either an eligible or permanent eligible member. Attackers may attempt to disrupt privileged access controls or alter role membership during staging, persistence, or cover-up. It relies on Azure audit log messages that explicitly indicate privileged role member removals.

Reporting behind it

Related detections9 linkedT1098 — drag to rearrange

Malicious Domain and Enterprise Admins Group Addition via net group Domain Add (via process_creation)

Suspicious Route53 Domain Transfer Lock Disabled via Scattered Spider Technique

Suspicious Domain Admin Account Creation via net (via process_creation)

Suspicious Guest Account Privilege Escalation (via process_creation)

Suspicious Login Shell Assigned to Service Account games on Linux

Suspicious dMSA Object Access with Migration AccessMask

Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

Suspicious Compute Instance Metadata Modification in GCP

Suspicious Azure AD Authentication Method Registration for Account Takeover (via azure)

Azure Audit Logs: Removal of Privileged Role Eligible Members

Pivot detection · T1098 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-audit-logs-bulk-removal-of-privileged-role-members-102e11e3

title: "Azure Audit Logs: Removal of Privileged Role Eligible Members"
id: ac63aceb-e596-4027-ae66-a772a9d31c02
status: test
description: This rule flags audit log events where a user is removed from a privileged role as either an eligible or permanent eligible member. Attackers may attempt to disrupt privileged access controls or alter role membership during staging, persistence, or cover-up. It relies on Azure audit log messages that explicitly indicate privileged role member removals.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-08-05
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
      - Remove eligible member (permanent)
      - Remove eligible member (eligible)
  condition: selection
falsepositives:
  - Legtimate administrator actions of removing members from a role
level: high
license: DRL-1.1
related:
  - id: 102e11e3-2db5-4c9e-bc26-357d42585d21
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL