Azure Subscription Permission Elevation Via AuditLogs

calendar Oct 2, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078  ·
Share on: linkedin copy

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Sigma rule (View on GitHub)

 1title: Azure Subscription Permission Elevation Via AuditLogs
 2id: ca9bf243-465e-494a-9e54-bf9fc239057d
 3status: test
 4description: |
 5    Detects when a user has been elevated to manage all Azure Subscriptions.
 6    This change should be investigated immediately if it isn't planned.
 7    This setting could allow an attacker access to Azure subscriptions in your environment.    
 8references:
 9    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
10author: Austin Songer @austinsonger
11date: 2021-11-26
12modified: 2026-09-26
13tags:
14    - attack.privilege-escalation
15    - attack.persistence
16    - attack.initial-access
17    - attack.stealth
18    - attack.t1078
19logsource:
20    product: azure
21    service: auditlogs
22detection:
23    selection:
24        Category: 'AzureRBACRoleManagementElevateAccess'
25        ActivityDisplayName: 'User has elevated their access to User Access Administrator for their Azure Resources'
26    condition: selection
27falsepositives:
28    - If this was approved by System Administrator.
29level: high

References

Related rules

to-top