Azure Audit Logs: User type changed from Guest to Member

Alerts when an Azure user’s UserType is updated from Guest to Member, indicating potential privilege elevation.

FreeUnreviewedSigmamediumv1

azure-audit-logs-user-type-changed-from-guest-to-member-8dee7a0d

title: "Azure Audit Logs: User type changed from Guest to Member"
id: 29ce7a7e-14eb-40f6-b594-3e9464e317f8
status: test
description: This rule flags an Azure audit log event where a user management update changes the UserType field from Guest to Member. Such changes matter because they can indicate elevation of access or permission scope beyond external/limited guest status. The detection relies on AuditLogs entries with UserManagement category, Update user operation, and a message indicating oldValue "Guest" and newValue "Member" for the UserType property.
references:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_guest_to_member.yml
author: MikeDuddington, '@dudders1', Huntrule Team
date: 2022-06-30
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    Category: UserManagement
    OperationName: Update user
    properties.message: '"displayName":"UserType","oldValue":"[\"Guest\"]","newValue":"[\"Member\"]"'
  condition: selection
falsepositives:
  - If this was approved by System Administrator.
level: medium
license: DRL-1.1
related:
  - id: 8dee7a0d-43fd-4b3c-8cd1-605e189d195e
    type: derived

What it detects

This rule flags an Azure audit log event where a user management update changes the UserType field from Guest to Member. Such changes matter because they can indicate elevation of access or permission scope beyond external/limited guest status. The detection relies on AuditLogs entries with UserManagement category, Update user operation, and a message indicating oldValue "Guest" and newValue "Member" for the UserType property.

Known false positives

If this was approved by System Administrator.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.