Sentinel detections for Azure Activity

id: be5a60f1-4785-4201-842f-78c92b8156d1
title: Azure Logic Apps Privilege Escalation via Improper Access Control
status: test
description: Detects privilege escalation attempts in Azure Logic Apps through improper access control mechanisms. Adversaries
  with authorized access abuse Logic Apps' access control to elevate privileges over the network. This detection monitors
  for operations that modify Logic App access policies or role assignments, which are common vectors for privilege escalation
  in Logic Apps environments.
author: CloudSigma
date: 2026/05/15
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-42823
- https://attack.mitre.org/techniques/T1548/
tags:
- attack.privilege_escalation
- attack.stealth
- attack.t1548
logsource:
  product: azure
  service: activitylogs
detection:
  condition: selection_operation and selection_target_type
  selection_operation:
    operationName:
    - Microsoft.Logic/workflows/accessKeys/write
    - Microsoft.Logic/workflows/accessKeys/action
    - Microsoft.Logic/workflows/providers/roleAssignments/write
    - Microsoft.Logic/integrationAccounts/accessKeys/write
  selection_target_type:
    properties.targetResources.type|startswith: Microsoft.Logic/
falsepositives:
- Legitimate Logic App access key rotation during maintenance windows
- Infrastructure-as-Code deployments provisioning Logic Apps with role assignments
- Authorized administrators configuring Logic App access policies for legitimate business workflows
- Service principal operations during Logic App migration or disaster recovery procedures
level: high