Azure Entra: Detect Member Removal From Group With Conditional Access Policy Modification Rights

title: "Azure Entra: Detect Member Removal From Group With Conditional Access Policy Modification Rights"
id: a67a055a-e098-4c74-bd03-2475632a8151
status: test
description: This rule flags audit events where a user is removed from a group and the affected group is one that can modify Conditional Access policies. Removing members from privileged groups can disrupt legitimate access controls or facilitate persistence by controlling who holds CA modification capabilities. The detection relies on Azure audit log entries containing the action message indicating “Remove member from group.”
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml
author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule Team
date: 2022-08-04
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.persistence
  - attack.defense-impairment
  - attack.t1548
  - attack.t1556
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Remove member from group
  condition: selection
falsepositives:
  - User removed from the group is approved
level: medium
license: DRL-1.1
related:
  - id: 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
    type: derived