Tag
Azure AD User Added to Global or Device Admin Role
2 rules 3 TTPsAn attacker may attempt to add a user to a high-privilege Azure AD role, such as Global Administrator or Device Administrator, to establish persistence, gain initial access, escalate privileges, or operate stealthily within the compromised environment.
Azure AD Privileged Authentication Administrator Role Assignment Detected
2 rules 2 TTPsAn adversary assigning the 'Privileged Authentication Administrator' role to an account in Azure AD could abuse the new privileges to reset authentication methods for privileged accounts, leading to account takeover and privilege escalation.
Azure AD PIM Role Assignment Detected
2 rules 2 TTPsDetection of an Azure AD Privileged Identity Management (PIM) role assignment, specifically identifying when a user is added as an eligible member, which could lead to unauthorized access and privilege escalation.
Azure AD Application Administrator Role Assigned to User
2 rules 1 TTPAn adversary may assign the Azure AD Application Administrator role to a user account for privilege escalation and application credential management, potentially leading to sensitive resource access and tenant compromise.
Azure AD Privileged Role Assignment
2 rules 2 TTPsDetection of a user being added to a privileged role in Azure AD, potentially indicating privilege escalation or persistence by an attacker.
Azure PIM - Role Assignment Outside of Privileged Identity Management
2 rules 4 TTPsDetection of privilege role assignments outside of Azure Privileged Identity Management (PIM) can indicate potential attacker activity related to initial access, stealth, persistence, or privilege escalation within the Azure environment.