Azure RBAC Elevate Access

Back


Id	132fdff4-c044-4855-a390-c1b71e0f833b
Rulename	Azure RBAC (Elevate Access)
Description	Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. Learn more
Severity	High
Tactics	PrivilegeEscalation
Techniques	T1078
Required data connectors	AzureActiveDirectory
Kind	Scheduled
Query frequency	2h
Query period	2h
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/AzureRBAC.yaml
Version	1.0.0
Arm template	132fdff4-c044-4855-a390-c1b71e0f833b.json

KQL

AuditLogs
| where Category =~ "AzureRBACRoleManagementElevateAccess"
| where ActivityDisplayName =~ "User has elevated their access to User Access Administrator for their Azure Resources"
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend IPAddress = tostring(InitiatedBy.user.ipAddress) 
| project
    TimeGenerated,
    Actor,
    OperationName,
    IPAddress,
    Result,
    LoggedByService

YAML

kind: Scheduled
triggerThreshold: 0
enabled: true
triggerOperator: GreaterThan
version: 1.0.0
tactics:
- PrivilegeEscalation
queryPeriod: 2h
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: false
    matchingMethod: AllEntities
    groupByAlertDetails: []
    groupByEntities: []
    groupByCustomDetails: []
    lookbackDuration: PT5H
suppressionDuration: PT5H
queryFrequency: 2h
id: 132fdff4-c044-4855-a390-c1b71e0f833b
requiredDataConnectors:
- connectorId: AzureActiveDirectory
  dataTypes:
  - AuditLogs
suppressionEnabled: false
alertRuleTemplateName: 
relevantTechniques:
- T1078
description: |
    'Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. [Learn more](https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal)'
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Actor
    identifier: Name
- entityType: IP
  fieldMappings:
  - columnName: IPAddress
    identifier: Address
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/AzureRBAC.yaml
name: Azure RBAC (Elevate Access)
severity: High
query: |
  AuditLogs
  | where Category =~ "AzureRBACRoleManagementElevateAccess"
  | where ActivityDisplayName =~ "User has elevated their access to User Access Administrator for their Azure Resources"
  | extend Actor = tostring(InitiatedBy.user.userPrincipalName)
  | extend IPAddress = tostring(InitiatedBy.user.ipAddress) 
  | project
      TimeGenerated,
      Actor,
      OperationName,
      IPAddress,
      Result,
      LoggedByService  
eventGroupingSettings:
  aggregationKind: SingleAlert

ARM