Detects role assignments, permission or right grants, admin grants and elevation events that the acting user has not performed against the same target in the prior 14 days. Only grant-type actions (added / assigned / granted / elevated / approved / created / updated) against role, permission, privilege, admin or entitlement objects are considered; removals and read-only events are excluded, and plain group-membership or ownership events are not matched because they make up most routine directory activity. One alert is produced per actor per run - review the FieldChanges column for the before/after of each change. Tune 'escalationObjects' and 'grantVerbs' to your tenant's event taxonomy, and use 'excludedEventNames', 'excludedServiceTypes' and 'excludedActors' to silence known-benign events, services (for example directory synchronization) and service accounts.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.