Post-Compromise Directory Manipulation: Roles, Resets, New Users

Ibrahim Saud@tektrix

•updated Sep 19, 2026•3•0•5

Detects high-velocity administrative activity performed by a single user account in Azure Active Directory, specifically focusing on account provisioning and role membership changes. The rule flags patterns such as password resets, enabling/disabling accounts, adding new users, and privilege escalation (e.g., granting Global Administrator roles), which are indicative of malicious post-compromise activity.