Azure Audit Logs: User Added to Privileged Role

Alerts on Azure audit log events indicating a user was added as an eligible or permanent member to a privileged role.

FreeUnreviewedSigmahighv1

azure-audit-logs-user-added-to-privileged-role-49a268a4

title: "Azure Audit Logs: User Added to Privileged Role"
id: 2a2ad4ae-abff-42c9-9bba-4fc638efef37
status: test
description: This rule flags Azure audit log events where an eligible member is added, matching messages for adding eligible members as eligible or permanent. Adding users to privileged roles can enable persistence and privilege escalation, so these changes should be reviewed for authorization and legitimacy. It relies on Azure audit logs capturing the specific privileged role membership change messages.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-08-06
tags:
  - attack.persistence
  - attack.initial-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
      - Add eligible member (permanent)
      - Add eligible member (eligible)
  condition: selection
falsepositives:
  - Legtimate administrator actions of adding members from a role
level: high
license: DRL-1.1
related:
  - id: 49a268a4-72f4-4e38-8a7b-885be690c5b5
    type: derived

What it detects

This rule flags Azure audit log events where an eligible member is added, matching messages for adding eligible members as eligible or permanent. Adding users to privileged roles can enable persistence and privilege escalation, so these changes should be reviewed for authorization and legitimacy. It relies on Azure audit logs capturing the specific privileged role membership change messages.

Known false positives

Legtimate administrator actions of adding members from a role

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.