Azure AuditLogs: Permission Elevation to User Access Administrator for Subscriptions

Flags Azure AuditLogs events where a user is assigned to User Access Administrator, enabling full subscription management.

FreeUnreviewedSigmahighv1

azure-auditlogs-permission-elevation-to-user-access-administrator-for-subscripti-ca9bf243

title: "Azure AuditLogs: Permission Elevation to User Access Administrator for Subscriptions"
id: e2bcddb3-cc7a-40db-8130-8b7be794a2a9
status: test
description: This rule flags Azure AuditLogs events where the caller is assigned to the User Access Administrator role, granting the ability to manage all Azure subscriptions. Role assignments like this can enable attackers to gain broad administrative access and persist within the environment if done without authorization. The detection relies on Azure AuditLogs fields for Category and OperationName indicating the specific administrative assignment action.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-26
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    Category: Administrative
    OperationName: Assigns the caller to user access admin
  condition: selection
falsepositives:
  - If this was approved by System Administrator.
level: high
license: DRL-1.1
related:
  - id: ca9bf243-465e-494a-9e54-bf9fc239057d
    type: derived

What it detects

This rule flags Azure AuditLogs events where the caller is assigned to the User Access Administrator role, granting the ability to manage all Azure subscriptions. Role assignments like this can enable attackers to gain broad administrative access and persist within the environment if done without authorization. The detection relies on Azure AuditLogs fields for Category and OperationName indicating the specific administrative assignment action.

Known false positives

If this was approved by System Administrator.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.