Azure Entra Audit Logs: User Account Added and Deleted Quickly

Identifies successful Azure user creation and deletion in quick succession, consistent with short-lived account activity.

FreeUnreviewedSigmahighv1

azure-entra-audit-logs-user-account-added-and-deleted-quickly-6f583da0

title: "Azure Entra Audit Logs: User Account Added and Deleted Quickly"
id: d7ad26ac-89c4-40d1-aa43-f73500af35cd
status: test
description: This rule flags successful user account creation and deletion occurring within a close time frame, based on audit log messages for adding and deleting users. Attackers may use short-lived accounts to reduce time on systems and lower the chance of detection during initial access or persistence attempts. The detection relies on Azure audit log events that include the specific success messages for “Add user” and “Delete user.”
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#short-lived-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_account_created_deleted.yml
author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton, Huntrule Team
date: 2022-08-11
modified: 2022-08-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message:
      - Add user
      - Delete user
    Status: Success
  condition: selection
falsepositives:
  - Legit administrative action
level: high
license: DRL-1.1
related:
  - id: 6f583da0-3a90-4566-a4ed-83c09fe18bbf
    type: derived

What it detects

This rule flags successful user account creation and deletion occurring within a close time frame, based on audit log messages for adding and deleting users. Attackers may use short-lived accounts to reduce time on systems and lower the chance of detection during initial access or persistence attempts. The detection relies on Azure audit log events that include the specific success messages for “Add user” and “Delete user.”

Known false positives

Legit administrative action

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.