Azure AD User Type Changed From Guest To Member
This rule detects when a user's account type is changed from 'Guest' to 'Member' within Azure Active Directory. This change signifies an elevation of privileges for the user, as 'Member' accounts typically have broader access and capabilities compared to 'Guest' accounts. Such a modification could be an indicator of an adversary attempting to gain higher privileges or establish persistence within the cloud environment.
Sigma
