sigmamediumHunting

User Added to an Administrator's Azure AD Role

MITRE ATT&CK

initial-accesspersistenceprivilege-escalation

Detection Query

selection:
  operationName: Add member to role
  properties.targetResources|contains:
    - Admins
    - Administrator
condition: selection

Author

Raphaël CALVET, @MetallicHack

Created

2021-10-04

Data Sources

azureauditlogs

Platforms

azure

References

Tags

attack.initial-accessattack.persistenceattack.privilege-escalationattack.stealthattack.t1098.003attack.t1078

Raw Content

title: User Added to an Administrator's Azure AD Role
id: ebbeb024-5b1d-4e16-9c0c-917f86c708a7
status: test
description: User Added to an Administrator's Azure AD Role
references:
    - https://web.archive.org/web/20250904191633/https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/
    - https://research.splunk.com/cloud/a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a/
    - https://analyticsrules.exchange/analyticrules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b/
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
author: Raphaël CALVET, @MetallicHack
date: 2021-10-04
modified: 2026-04-30
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1098.003
    - attack.t1078
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        operationName: 'Add member to role'
        properties.targetResources|contains:
            - 'Admins'
            - 'Administrator'
    condition: selection
falsepositives:
    - PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled.
level: medium