Techniques
Sample rules
Azure Subscription Permission Elevation Via ActivityLogs
- source: sigma
- technicques:
- t1078
- t1078.004
Description
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn’t planned. This setting could allow an attacker access to Azure subscriptions in your environment.
Detection logic
condition: selection
selection:
operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION
Azure AD Only Single Factor Authentication Required
- source: sigma
- technicques:
- t1078
- t1078.004
- t1556
- t1556.006
Description
Detect when users are authenticating without MFA being required.
Detection logic
condition: selection
selection:
AuthenticationRequirement: singleFactorAuthentication
Status: Success
User State Changed From Guest To Member
- source: sigma
- technicques:
- t1078
- t1078.004
Description
Detects the change of user type from “Guest” to “Member” for potential elevation of privilege.
Detection logic
condition: selection
selection:
Category: UserManagement
OperationName: Update user
properties.message: '"displayName":"UserType","oldValue":"[\"Guest\"]","newValue":"[\"Member\"]"'
Azure Subscription Permission Elevation Via AuditLogs
- source: sigma
- technicques:
- t1078
Description
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn’t planned. This setting could allow an attacker access to Azure subscriptions in your environment.
Detection logic
condition: selection
selection:
Category: Administrative
OperationName: Assigns the caller to user access admin