sigmahighHunting

Azure Subscription Permission Elevation Via AuditLogs

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

MITRE ATT&CK

T1078

privilege-escalationpersistenceinitial-access

Detection Query

selection:
  Category: AzureRBACRoleManagementElevateAccess
  ActivityDisplayName: User has elevated their access to User Access Administrator
    for their Azure Resources
condition: selection

Author

Austin Songer @austinsonger

Created

2021-11-26

Data Sources

azureauditlogs

Platforms

azure

References

https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation

Tags

attack.privilege-escalationattack.persistenceattack.initial-accessattack.stealthattack.t1078

Raw Content

title: Azure Subscription Permission Elevation Via AuditLogs
id: ca9bf243-465e-494a-9e54-bf9fc239057d
status: test
description: |
    Detects when a user has been elevated to manage all Azure Subscriptions.
    This change should be investigated immediately if it isn't planned.
    This setting could allow an attacker access to Azure subscriptions in your environment.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
author: Austin Songer @austinsonger
date: 2021-11-26
modified: 2026-09-26
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        Category: 'AzureRBACRoleManagementElevateAccess'
        ActivityDisplayName: 'User has elevated their access to User Access Administrator for their Azure Resources'
    condition: selection
falsepositives:
    - If this was approved by System Administrator.
level: high