Azure Audit Logs: Privileged Account Creation via Admin Role Assignment

title: "Azure Audit Logs: Privileged Account Creation via Admin Role Assignment"
id: 5cbc493e-013a-4a68-a216-5fdd865f05d7
status: test
description: This rule identifies successful events in Azure audit logs where a user is added and assigned to a role, matching messages containing both “Add user” and “Add member to role.” Creating or granting admin privileges is a common attacker technique for establishing persistence and escalating access. The detection relies on audit log message text and a Success status to confirm the action occurred.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_privileged_account_creation.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton, Huntrule Team
date: 2022-08-11
modified: 2022-08-16
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message|contains|all:
      - Add user
      - Add member to role
    Status: Success
  condition: selection
falsepositives:
  - A legitimate new admin account being created
level: medium
license: DRL-1.1
related:
  - id: f7b5b004-dece-46e4-a4a5-f6fd0e1c6947
    type: derived