Sigma rule: Azure Subscription Permission Elevation Via AuditLogs

Rule

Title

Azure Subscription Permission Elevation Via AuditLogs

Status

test

Level

high

Author

Austin Songer @austinsonger

Date

2021-11-26

Modified

2026-09-26

File

rules/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.

Log source

product

azure

service

auditlogs

Detection

selection:
    Category: 'AzureRBACRoleManagementElevateAccess'
    ActivityDisplayName: 'User has elevated their access to User Access Administrator for their Azure Resources'
condition: selection

False positives (as the rule lists them)

• If this was approved by System Administrator.

Tags

• attack.privilege-escalation
• attack.persistence
• attack.initial-access
• attack.stealth
• attack.t1078

MITRE ATT&CK ids this rule names

• T1078

References

• https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml