Azure Audit Logs: Privileged Account Creation via Admin Role Assignment
Flags successful events where a user is added and added to a role, indicating new admin account creation in Azure.
- Product
- azure
- Service
- auditlogs
- Author
- Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2022-08-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies successful events in Azure audit logs where a user is added and assigned to a role, matching messages containing both “Add user” and “Add member to role.” Creating or granting admin privileges is a common attacker technique for establishing persistence and escalating access. The detection relies on audit log message text and a Success status to confirm the action occurred.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Audit Logs: Privileged Account Creation via Admin Role Assignment"
id: 5cbc493e-013a-4a68-a216-5fdd865f05d7
status: test
description: This rule identifies successful events in Azure audit logs where a user is added and assigned to a role, matching messages containing both “Add user” and “Add member to role.” Creating or granting admin privileges is a common attacker technique for establishing persistence and escalating access. The detection relies on audit log message text and a Success status to confirm the action occurred.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_privileged_account_creation.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton, Huntrule Team
date: 2022-08-11
modified: 2022-08-16
tags:
- attack.initial-access
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1078.004
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message|contains|all:
- Add user
- Add member to role
Status: Success
condition: selection
falsepositives:
- A legitimate new admin account being created
level: medium
license: DRL-1.1
related:
- id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947
type: derived