splunk_escuTTP

Azure AD Global Administrator Role Assigned

The following analytic detects the assignment of the Azure AD Global Administrator role to a user. It leverages Azure Active Directory AuditLogs to identify when the "Add member to role" operation includes the "Global Administrator" role. This activity is significant because the Global Administrator role grants extensive access to data, resources, and settings, similar to a Domain Administrator in traditional AD environments. If confirmed malicious, this could allow an attacker to establish persistence, escalate privileges, and potentially gain control over Azure resources, posing a severe security risk.

MITRE ATT&CK

T1098.003

Detection Query

`azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="*Global Administrator*"
  | rename properties.* as *
  | rename initiatedBy.user.userPrincipalName as initiatedBy
  | rename userAgent as user_agent
  | fillnull
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY dest user src
       vendor_account vendor_product user_agent
       initiatedBy signature
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `azure_ad_global_administrator_role_assigned_filter`

Author

Gowthamaraj Rajendran, Mauricio Velazco, Splunk

Created

2026-03-10

Data Sources

Azure Active Directory Add member to role

References

Tags

Azure Active Directory PersistenceAzure Active Directory Privilege EscalationScattered Lapsus$ Hunters

Raw Content

name: Azure AD Global Administrator Role Assigned
id: 825fed20-309d-4fd1-8aaf-cd49c1bb093c
version: 13
date: '2026-03-10'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of the Azure AD Global Administrator role to a user. It leverages Azure Active Directory AuditLogs to identify when the "Add member to role" operation includes the "Global Administrator" role. This activity is significant because the Global Administrator role grants extensive access to data, resources, and settings, similar to a Domain Administrator in traditional AD environments. If confirmed malicious, this could allow an attacker to establish persistence, escalate privileges, and potentially gain control over Azure resources, posing a severe security risk.
data_source:
    - Azure Active Directory Add member to role
search: |-
    `azure_monitor_aad` operationName="Add member to role" properties.targetResources{}.modifiedProperties{}.newValue="*Global Administrator*"
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy
      | rename userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product user_agent
           initiatedBy signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_global_administrator_role_assigned_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLogs log category.
known_false_positives: Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
references:
    - https://o365blog.com/post/admin/
    - https://adsecurity.org/?p=4277
    - https://www.mandiant.com/resources/detecting-microsoft-365-azure-active-directory-backdoors
    - https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning
    - https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin
    - https://attack.mitre.org/techniques/T1098/003/
drilldown_searches:
    - name: View the detection results for - "$user$"
      search: '%original_detection_search% | search  user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: Global Administrator Role assigned for User $user$ initiated by $initiatedBy$
    risk_objects:
        - field: user
          type: user
          score: 50
        - field: initiatedBy
          type: user
          score: 50
    threat_objects: []
tags:
    analytic_story:
        - Azure Active Directory Persistence
        - Azure Active Directory Privilege Escalation
        - Scattered Lapsus$ Hunters
    asset_type: Azure Active Directory
    mitre_attack_id:
        - T1098.003
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit.log
          source: Azure AD
          sourcetype: azure:monitor:aad