Azure Subscription Permission Elevation Via AuditLogs — Sigma Rule

Rule metadata and linked tags

Author: Austin Songer @austinsonger. Source status: test; severity: high. Source dates: 2021-11-26 / 2022-12-25.

{
  "product": "azure",
  "service": "auditlogs"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 714a32b6461d3a7ed8ce4c8bf0412050a80ec39217869886afcd3e48a8896544

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Azure Subscription Permission Elevation Via AuditLogs
id: ca9bf243-465e-494a-9e54-bf9fc239057d
status: test
description: |
    Detects when a user has been elevated to manage all Azure Subscriptions.
    This change should be investigated immediately if it isn't planned.
    This setting could allow an attacker access to Azure subscriptions in your environment.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
author: Austin Songer @austinsonger
date: 2021-11-26
modified: 2022-12-25
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        Category: 'Administrative'
        OperationName: 'Assigns the caller to user access admin'
    condition: selection
falsepositives:
    - If this was approved by System Administrator.
level: high

Original YAML and metadata in JSON

False positives

• If this was approved by System Administrator.

Source references

• https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation