App Assigned To Azure RBAC/Microsoft Entra Role

Status: test
Severity: medium
Log source: product azure, service auditlogs
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
Source: github.com/SigmaHQ/sigma

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Known false positives

When the permission is legitimately needed for the app

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098.003` Account Manipulation: Additional Cloud Roles
Privilege Escalation	`T1098.003` Account Manipulation: Additional Cloud Roles

Telemetry coverage

Platform	Record / event type
Azure	Add eligible member to role
Azure	Add member to role
Azure	Add scoped member to role

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: App Assigned To Azure RBAC/Microsoft Entra Role
id: b04934b2-0a68-4845-8a19-bdfed3a68a7a
status: test
description: Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
date: 2022-07-19
modified: 2024-11-04
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098.003
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        targetResources.type: 'Service Principal'
        properties.message:
            - Add member to role
            - Add eligible member to role
            - Add scoped member to role
    condition: selection
falsepositives:
    - When the permission is legitimately needed for the app
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    targetResources.type: 'Service Principal'
    properties.message:
        - Add member to role
        - Add eligible member to role
        - Add scoped member to role

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`properties.message`	eq	`Add eligible member to role` `Add member to role` `Add scoped member to role`	`field:"properties.message" kind:eq`
`targetResources.type`	eq	`Service Principal`	`field:"targetResources.type" kind:eq value:"Service Principal"`