Azure Subscription Permission Elevation Via ActivityLogs

Status: test
Severity: high
Log source: product azure, service activitylogs
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Known false positives

If this was approved by System Administrator.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts

Telemetry coverage

Platform	Record / event type
Azure	Activity Log event `Microsoft.Authorization/elevateAccess/action`: Grants the caller User Access Administrator access at the tenant scope

Rule body

title: Azure Subscription Permission Elevation Via ActivityLogs
id: 09438caa-07b1-4870-8405-1dbafe3dad95
status: test
description: |
    Detects when a user has been elevated to manage all Azure Subscriptions.
    This change should be investigated immediately if it isn't planned.
    This setting could allow an attacker access to Azure subscriptions in your environment.
references:
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization
author: Austin Songer @austinsonger
date: 2021-11-26
modified: 2022-08-23
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078.004
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION
    condition: selection
falsepositives:
    - If this was approved by System Administrator.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`operationName`	eq	`MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION`	`field:"operationName" kind:eq value:"MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION"`