Administrative Role Assignment from Multiple IP Addresses

Ankit Mehta@Secvyn

•updated Jun 4, 2026•2•0•5

This rule detects when a user account assigns a 'Global Administrator' or 'Owner' role from multiple distinct IP addresses within a one-hour window. This behavior can indicate a compromised account being used to escalate privileges or establish persistence from different locations.