• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Risky Sign-in with ElevateAccess

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•25

    Looks for users who had a risky sign in (based on Entra ID Identity Protection risk score) and then performed and ElevateAccess action. ElevateAccess operations can be used by Global Admins to obtain permissions over Azure resources.

    Microsoft Sentinel (KQL)

    Tags

    TA0004 - Privilege EscalationT1068 - Exploitation for Privilege EscalationT1651 - Cloud Administration CommandT1078.004 - Cloud AccountsTA0002 - ExecutionTA0005 - Defense EvasionTA0003 - PersistenceTA0001 - Initial AccessAuthentication AttemptAuthentication SuccessAuthentication FailureAdmin ActivityCloud Api CallCredential AccessLogon EventUser Account ModifiedAzureAzure Activity LogsAzure Signin LogsAzure Ad Risk Detectionkqltactic:PrivilegeEscalation

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?