User Added to an Administrator's Azure AD Role — Sigma Rule

Rule metadata and linked tags

Author: Raphaël CALVET, @MetallicHack. Source status: test; severity: medium. Source dates: 2021-10-04 / 2022-10-09.

{
  "product": "azure",
  "service": "activitylogs"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 8ec61424a82a412d9e5fbd0e74f0abf9df1da65191c579244987333d78800f89

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: User Added to an Administrator's Azure AD Role
id: ebbeb024-5b1d-4e16-9c0c-917f86c708a7
status: test
description: User Added to an Administrator's Azure AD Role
references:
    - https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/
author: Raphaël CALVET, @MetallicHack
date: 2021-10-04
modified: 2022-10-09
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1098.003
    - attack.t1078
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        Operation: 'Add member to role.'
        Workload: 'AzureActiveDirectory'
        ModifiedProperties{}.NewValue|endswith:
            - 'Admins'
            - 'Administrator'
    condition: selection
falsepositives:
    - PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled.
level: medium

Original YAML and metadata in JSON

False positives

• PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled.

Source references

• https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/