Suspicious User Added to an Administrator's Azure AD Role (via auditlogs)

title: Suspicious User Added to an Administrator's Azure AD Role (via auditlogs)
id: 4ffdb478-0b1e-55e1-b368-f87bbc1e546e
status: stable
description: This rule detects user Added to an Administrator's Azure AD Role
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://attack.mitre.org/techniques/T1098/003/
    - https://web.archive.org/web/20250904191633/https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/
    - https://research.splunk.com/cloud/a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a/
    - https://analyticsrules.exchange/analyticrules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b/
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
author: Huntrule Team
date: 2026-01-15
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1098.003
    - attack.t1078
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        operationName: 'Add member to role'
        properties.targetResources|contains:
            - 'Admins'
            - 'Administrator'
    condition: selection
falsepositives:
    - Unknown
level: medium