Azure Subscription Permission Elevation Via AuditLogs

Status: test
Severity: high
Log source: product azure, service auditlogs
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Known false positives

If this was approved by System Administrator.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
Azure	Assigns the caller to user access admin

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: Azure Subscription Permission Elevation Via AuditLogs
id: ca9bf243-465e-494a-9e54-bf9fc239057d
status: test
description: |
    Detects when a user has been elevated to manage all Azure Subscriptions.
    This change should be investigated immediately if it isn't planned.
    This setting could allow an attacker access to Azure subscriptions in your environment.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
author: Austin Songer @austinsonger
date: 2021-11-26
modified: 2022-12-25
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        Category: 'Administrative'
        OperationName: 'Assigns the caller to user access admin'
    condition: selection
falsepositives:
    - If this was approved by System Administrator.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Category: 'Administrative'
    OperationName: 'Assigns the caller to user access admin'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Category`	eq	`Administrative`	`field:"Category" kind:eq value:"Administrative"`
`OperationName`	eq	`Assigns the caller to user access admin`	`field:"OperationName" kind:eq value:"Assigns the caller to user access admin"`