Query: write Sigma for User Added to an Administrator's Azure AD Role
Matching passage: Sigma rule: User Added to an Administrator's Azure AD Role. Logsource: azure / auditlogs. Rule: title: User Added to an Administrator's Azure AD Role id: ebbeb024-5b1d-4e16-9c0c-917f86c708a7 status: test description: User Added to an Administrator's Azure AD Role references: - https://web.archive.org/web/20250904191633/https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/ - https://research.splunk.com/cloud/a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a/ - https://analyticsrules.exchange/analyticrules/2a09f8cb-deb7-4c40-b08b-9137667f1c0b/ - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Raphaël CALVET, @MetallicHack date: 2021-10-04 modified: 2026-04-30 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1098.003 - attack.t1078 logsource: product: azure service: auditlogs detection: selection: operationName: Add member to role properties.targetResources|contains: - Admins - Administrator condition: selection falsepositives: - PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled. level: medium
Near-miss passage: Sigma rule: Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter'. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded By Non PowerShell Process id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f related: - id: 867613fb-fa60-4497-a017-a82df74a172c type: obsolete - id: fe6e002f-f244-4278-9263-20e4b593827f type: obsolete status: test description: 'Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter''s "load powershell" extension. ' references: - https://adsecurity.org/?p=2921 - https://github.com/p3nt4/PowerShdll author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-11-14 modified: 2026-07-28 tags: - attack.t1059.001 - attack.execution logsource: category: image_load product: windows detection: selection: - Description: System.Management.Automation - OriginalFileName: System.Management.Automation.dll - ImageLoaded|endswith: - \System.Management.Automation.dll - \System.Management.Automation.ni.dll filter_main_powershell: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_pwsh_preview: Image|contains: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_generic: Image: - C:\Windows\System32\dsac.exe - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe - C:\Windows\System32\runscripthelper.exe - C:\WINDOWS\System32\sdiagnhost.exe - C:\Windows\System32\ServerManager.exe - C:\Windows\System32\SyncAppvPublishingServer.exe - C:\Windows\System32\winrshost.exe - C:\Windows\System32\wsmprovhost.exe - C:\Windows\SysWOW64\winrshost.exe - C:\Windows\SysWOW64\wsmprovhost.exe filter_main_dotnet: Image|startswith: - C:\Windows\Microsoft.NET\Framework\ - C:\Windows\Microsoft.NET\FrameworkArm\ - C:\Windows\Microsoft.NET\FrameworkArm64\ - C:\Windows\Microsoft.NET\Framework64\ Image|endswith: \mscorsvw.exe filter_optional_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_optional_sql_server_mgmt: Image|startswith: - C:\Program Files (x86)\Microsoft SQL Server Management Studio - C:\Program Files\Microsoft SQL Server Management Studio Image|endswith: \IDE\