Azure RBAC (Elevate Access)

Severity: high
Time window: 2h
Source: github.com/Azure/Azure-Sentinel

Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. Learn more

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
Azure	User has elevated their access to User Access Administrator for their Azure Resources

Rules detecting the same action

These rules filter on the same operation.

Entra ID Elevated Access to User Access Administrator (Elastic)

Rule body

id: 132fdff4-c044-4855-a390-c1b71e0f833b
name: Azure RBAC (Elevate Access)
kind: Scheduled
description: |
  'Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. [Learn more](https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal)'
severity: High
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
queryFrequency: 2h
queryPeriod: 2h
triggerOperator: GreaterThan
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
relevantTechniques: 
  - T1078
enabled: true
query: |
  AuditLogs
  | where Category =~ "AzureRBACRoleManagementElevateAccess"
  | where ActivityDisplayName =~ "User has elevated their access to User Access Administrator for their Azure Resources"
  | extend Actor = tostring(InitiatedBy.user.userPrincipalName)
  | extend IPAddress = tostring(InitiatedBy.user.ipAddress) 
  | project
      TimeGenerated,
      Actor,
      OperationName,
      IPAddress,
      Result,
      LoggedByService
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: Actor
  - entityType: IP
    fieldMappings:
      - identifier: Address 
        columnName: IPAddress
suppressionDuration: PT5H
suppressionEnabled: false
alertRuleTemplateName: null
incidentConfiguration: 
  createIncident: true
  groupingConfiguration: 
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.0

Stages and Predicates

Stage 1: `source`

AuditLogs

Stage 2: `where`

| where Category =~ "AzureRBACRoleManagementElevateAccess"

Stage 3: `where`

| where ActivityDisplayName =~ "User has elevated their access to User Access Administrator for their Azure Resources"

Stage 4: `extend`

| extend Actor = tostring(InitiatedBy.user.userPrincipalName)

Stage 5: `extend`

| extend IPAddress = tostring(InitiatedBy.user.ipAddress)

Stage 6: `project`

| project
    TimeGenerated,
    Actor,
    OperationName,
    IPAddress,
    Result,
    LoggedByService

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActivityDisplayName`	eq	`User has elevated their access to User Access Administrator for their Azure Resources`	`field:"azure_ad::activity_display_name" kind:eq value:"User has elevated their access to User Access Administrator for their Azure Resources"`
`Category`	eq	`AzureRBACRoleManagementElevateAccess`	`field:"Category" kind:eq value:"AzureRBACRoleManagementElevateAccess"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Actor`	`project`
`IPAddress`	`project`
`LoggedByService`	`project`
`OperationName`	`project`
`Result`	`project`
`TimeGenerated`	`project`