Sigma rule: User Added to an Administrator's Azure AD Role

Rule

Title

User Added to an Administrator's Azure AD Role

Status

test

Level

medium

Author

Raphaël CALVET, @MetallicHack

Date

2021-10-04

Modified

2026-04-30

File

rules/cloud/azure/audit_logs/azure_ad_user_added_to_admin_role.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

User Added to an Administrator's Azure AD Role

Log source

product

azure

service

auditlogs

Detection

selection:
    operationName: 'Add member to role'
    properties.targetResources|contains:
        - 'Admins'
        - 'Administrator'
condition: selection

False positives (as the rule lists them)

• PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled.

Tags

• attack.initial-access
• attack.persistence
• attack.privilege-escalation
• attack.stealth
• attack.t1098.003
• attack.t1078

MITRE ATT&CK ids this rule names

• T1078
• T1098.003

References

• https://web.archive.org/web/20250904191633/https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/
• https://research.splunk.com/cloud/a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a/
• https://analyticsrules.exchange/analyticrules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b/
• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/audit_logs/azure_ad_user_added_to_admin_role.yml