Azure Audit Logs: Successful Admin Account Creation via Add User to Role

title: "Azure Audit Logs: Successful Admin Account Creation via Add User to Role"
id: 5cbc493e-013a-4a68-a216-5fdd865f05d7
status: test
description: This rule identifies successful privileged account changes in Azure Audit Logs by matching audit messages that indicate a user was added and that the user was added to a role. Attackers often create new admin accounts to establish persistence and maintain long-term access. It relies on message content in the audit log entry plus a Success status to confirm the action completed.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_privileged_account_creation.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton, Huntrule Team
date: 2022-08-11
modified: 2022-08-16
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message|contains|all:
      - Add user
      - Add member to role
    Status: Success
  condition: selection
falsepositives:
  - A legitimate new admin account being created
level: medium
license: DRL-1.1
related:
  - id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947
    type: derived