Sunturai
Back to results
MediumSplunk security contentMauricio Velazco +2

Azure AD Privileged Role Assigned

The following analytic detects the assignment of privileged Azure Active Directory roles to a user. It leverages Azure AD audit logs, specifically monitoring the "Add member to role" operation. This activity is…

Description

The following analytic detects the assignment of privileged Azure Active Directory roles to a user. It leverages Azure AD audit logs, specifically monitoring the "Add member to role" operation. This activity is significant as adversaries may assign privileged roles to compromised accounts to maintain persistence within the Azure AD environment. If confirmed malicious, this could allow attackers to escalate privileges, access sensitive information, and maintain long-term control over the Azure AD infrastructure.

Detection logic

Detection requirements

Platform
IaaSIdentity ProviderOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
azure_active_directory_add_member_to_role

Known benign triggers

  • Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice