Detection rules › By catalog entryAzure-Microsoft.AuthorizationCatalog entryRulesMicrosoft.Authorization/elevateAccess/action2Microsoft.Authorization/locks/delete1Microsoft.Authorization/policies/audit/action1Microsoft.Authorization/policies/auditIfNotExists/action1Microsoft.Authorization/policies/deployIfNotExists/action1Microsoft.Authorization/roleAssignments/write5Microsoft.Authorization/elevateAccess/action#2 detection rules reference this catalog entry. View catalog entry.Sigma (1)Azure Subscription Permission Elevation Via ActivityLogs severity high T1078,T1078.004 Panther (1)Azure Privileged or Elevated Role Assignment severity medium T1078.004,T1098,T1098.003 Microsoft.Authorization/locks/delete#1 detection rules reference this catalog entry. View catalog entry.Panther (1)Azure Resource Lock Deleted severity high T1490,T1685 Microsoft.Authorization/policies/audit/action#1 detection rules reference this catalog entry. View catalog entry.Panther (1)Azure Policy Violation Detected severity informationalMicrosoft.Authorization/policies/auditIfNotExists/action#1 detection rules reference this catalog entry. View catalog entry.Panther (1)Azure Policy Violation Detected severity informationalMicrosoft.Authorization/policies/deployIfNotExists/action#1 detection rules reference this catalog entry. View catalog entry.Panther (1)Azure Policy DeployIfNotExists Action Triggered severity medium T1078.004,T1564 Microsoft.Authorization/roleAssignments/write#5 detection rules reference this catalog entry. View catalog entry.Sigma (2)Granting Of Permissions To An Account severity medium T1098,T1098.003 Role Assignment Created severity informationalElastic (1)Azure RBAC Built-In Administrator Roles Assigned severity high T1098,T1098.003 Kusto (1)Suspicious granting of permissions to an account severity medium T1098,T1548 Panther (1)Azure Privileged or Elevated Role Assignment severity medium T1078.004,T1098,T1098.003 Back to all Azure-Microsoft.Authorization catalog entries