detection.wiki

Detection rules › Panther

Azure Privileged or Elevated Role Assignment

Severity
medium
Log types
Azure.MonitorActivity
Tags
AZT402, Persistence, Defense Evasion, Account Manipulation, Add Office 365 Global Administrator Role, Valid Accounts, Cloud Accounts
Reference
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
Source
github.com/panther-labs/panther-analysis

Detects when a privileged or elevated Azure role is assigned. Privileged roles include Owner, Contributor, User Access Administrator, Security Admin, and other high-impact administrative roles. Elevated roles include resource-specific roles with significant permissions like Storage Blob Data Owner, Key Vault Administrator, etc.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1078.004 Valid Accounts: Cloud Accounts, T1098.003 Account Manipulation: Additional Cloud Roles
Privilege EscalationT1078.004 Valid Accounts: Cloud Accounts, T1098.003 Account Manipulation: Additional Cloud Roles
StealthT1078.004 Valid Accounts: Cloud Accounts

Rule body yaml

AnalysisType: rule
Filename: azure_role_assignment_privileged_or_elevated.py
RuleID: "Azure.MonitorActivity.RoleAssignment.PrivilegedOrElevated"
DisplayName: "Azure Privileged or Elevated Role Assignment"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Medium
Description: >
  Detects when a privileged or elevated Azure role is assigned.
  Privileged roles include Owner, Contributor, User Access Administrator, Security Admin, and other high-impact administrative roles.
  Elevated roles include resource-specific roles with significant permissions like Storage Blob Data Owner, Key Vault Administrator, etc.
Reports:
  MITRE ATT&CK:
    - TA0004:T1098 # Persistence: Account Manipulation
    - TA0003:T1098.003 # Persistence: Add Office 365 Global Administrator Role
    - TA0005:T1078.004 # Defense Evasion: Valid Accounts - Cloud Accounts
Tags:
  - AZT402
  - Persistence
  - Defense Evasion
  - Account Manipulation
  - Add Office 365 Global Administrator Role
  - Valid Accounts
  - Cloud Accounts
Runbook: |
  1. Find all Azure Monitor Activity role assignment and elevate access operations by the callerIpAddress in the 24 hours before and after the alert to identify if multiple privileged roles are being granted
  2. Query for all API calls by the principalId in the 6 hours after the role assignment to determine if newly granted permissions were immediately exploited
  3. Check if the callerIpAddress is associated with known VPN services or corporate IP ranges and compare to the caller's authentication patterns in the past 30 days
Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Owner Role Assignment
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/providers/Microsoft.Authorization/roleAssignments/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "operationName": "Microsoft.Authorization/roleAssignments/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "f1e2d3c4-b5a6-7890-bcde-f12345678901",
        "location": "",
        "tenantId": "87654321-4321-4321-4321-111111111111",
        "identity": {
          "authorization": {
            "action": "Microsoft.Authorization/roleAssignments/write",
            "evidence": {
              "principalId": "6b6d44f0-b13a-46a0-bfde-161324d4c34d",
              "principalType": "User",
              "role": "Owner",
              "roleAssignmentId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
              "roleAssignmentScope": "/subscriptions/12345678-1234-1234-1234-123456789abc",
              "roleDefinitionId": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635"
            }
          }
        },
        "properties": {
          "requestbody": "{\"Id\":\"a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\"Properties\":{\"PrincipalId\":\"770797c4-e05a-43f9-bda2-1f1f379987ae\",\"PrincipalType\":\"ServicePrincipal\",\"RoleDefinitionId\":\"/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635\",\"Scope\":\"/subscriptions/12345678-1234-1234-1234-123456789abc\"}}"
        }
      }
  - Name: Non-Privileged Role Assignment
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/providers/Microsoft.Authorization/roleAssignments/c3d4e5f6-a7b8-9012-cdef-111111111111",
        "operationName": "Microsoft.Authorization/roleAssignments/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "h3g4f5e6-d7c8-9012-def0-333333333333",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-222222222222",
        "identity": {
          "authorization": {
            "action": "Microsoft.Authorization/roleAssignments/write",
            "evidence": {
              "principalId": "6b6d44f0-b13a-46a0-bfde-161324d4c34d",
              "principalType": "User",
              "role": "Owner",
              "roleAssignmentId": "c3d4e5f6-a7b8-9012-cdef-111111111111",
              "roleAssignmentScope": "/subscriptions/12345678-1234-1234-1234-123456789abc",
              "roleDefinitionId": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635"
            }
          }
        },
        "properties": {
          "requestbody": "{\"Id\":\"c3d4e5f6-a7b8-9012-cdef-111111111111\",\"Properties\":{\"PrincipalId\":\"22222222-3333-4444-5555-666666666666\",\"PrincipalType\":\"User\",\"RoleDefinitionId\":\"/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7\",\"Scope\":\"/subscriptions/12345678-1234-1234-1234-123456789abc\"}}"
        }
      }
  - Name: Elevated Role Assignment (Storage Blob Data Owner)
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T14:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/providers/Microsoft.Authorization/roleAssignments/d4e5f6a7-b8c9-0123-def4-111111111111",
        "operationName": "Microsoft.Authorization/roleAssignments/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "i4h5g6f7-e8d9-0123-efgh-222222222222",
        "location": "westus",
        "tenantId": "87654321-4321-4321-4321-111111111111",
        "identity": {
          "authorization": {
            "action": "Microsoft.Authorization/roleAssignments/write",
            "evidence": {
              "principalId": "6b6d44f0-b13a-46a0-bfde-161324d4c34d",
              "principalType": "User",
              "role": "Owner",
              "roleAssignmentId": "d4e5f6a7-b8c9-0123-def4-111111111111",
              "roleAssignmentScope": "/subscriptions/12345678-1234-1234-1234-123456789abc",
              "roleDefinitionId": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635"
            }
          }
        },
        "properties": {
          "requestbody": "{\"Id\":\"d4e5f6a7-b8c9-0123-def4-111111111111\",\"Properties\":{\"PrincipalId\":\"33333333-4444-5555-6666-777777777777\",\"PrincipalType\":\"ServicePrincipal\",\"RoleDefinitionId\":\"/providers/Microsoft.Authorization/roleDefinitions/b7e6dc6d-f1e8-4753-8033-0f276bb0955b\",\"Scope\":\"/subscriptions/12345678-1234-1234-1234-123456789abc/resourcegroups/storage-rg/providers/Microsoft.Storage/storageAccounts/mystorageacct\"}}"
        }
      }
  - Name: Elevate Access to All Azure Subscriptions
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-24T15:45:00.0000000Z",
        "resourceId": "/providers/Microsoft.Authorization",
        "operationName": {
          "value": "Microsoft.Authorization/elevateAccess/action",
          "localizedValue": "Assigns the caller to User Access Administrator role"
        },
        "operationVersion": "2018-01-01-preview",
        "category": "Administrative",
        "resultType": "Success",
        "status": {
          "value": "Succeeded",
          "localizedValue": "Succeeded"
        },
        "callerIpAddress": "203.0.113.42",
        "correlationId": "a1b2c3d4-e5f6-7890-1234-567890abcdef",
        "tenantId": "87654321-4321-4321-4321-111111111111",
        "identity": {
          "claims": {
            "name": "attacker@example.com",
            "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "attacker@example.com"
          }
        },
        "level": "Information"
      }

Detection logic

Condition

(operationName.value is_not_null and operationName.value eq "MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION" and status.value eq "Succeeded") or (operationName eq "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE" and resultType in ["Success", "Succeeded"])

This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
operationNameeq
  • MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE
operationName.valueeq
  • MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION
operationName.valueis_not_null
  • (no value, null check)
resultTypein
  • Succeeded
  • Success
status.valueeq
  • Succeeded

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
nameidentity.claims.name
resourceId