Detection rules › By eventAzure-Microsoft.AuthorizationEventRulesMicrosoft.Authorization/elevateAccess/action2Microsoft.Authorization/locks/delete1Microsoft.Authorization/policies/audit/action1Microsoft.Authorization/policies/auditIfNotExists/action1Microsoft.Authorization/policies/deployIfNotExists/action1Microsoft.Authorization/roleAssignments/write5Microsoft.Authorization/elevateAccess/action#2 detection rules reference this event. View event page.Sigma (1)Azure Subscription Permission Elevation Via ActivityLogs severity high T1078,T1078.004 Panther (1)Azure Privileged or Elevated Role Assignment severity medium T1078.004,T1098,T1098.003 Microsoft.Authorization/locks/delete#1 detection rules reference this event. View event page.Panther (1)Azure Resource Lock Deleted severity high T1490,T1685 Microsoft.Authorization/policies/audit/action#1 detection rules reference this event. View event page.Panther (1)Azure Policy Violation Detected severity informationalMicrosoft.Authorization/policies/auditIfNotExists/action#1 detection rules reference this event. View event page.Panther (1)Azure Policy Violation Detected severity informationalMicrosoft.Authorization/policies/deployIfNotExists/action#1 detection rules reference this event. View event page.Panther (1)Azure Policy DeployIfNotExists Action Triggered severity medium T1078.004,T1564 Microsoft.Authorization/roleAssignments/write#5 detection rules reference this event. View event page.Sigma (2)Granting Of Permissions To An Account severity medium T1098,T1098.003 Role Assignment Created severity informationalElastic (1)Azure RBAC Built-In Administrator Roles Assigned severity high T1098,T1098.003 Kusto (1)Suspicious granting of permissions to an account severity medium T1098,T1548 Panther (1)Azure Privileged or Elevated Role Assignment severity medium T1078.004,T1098,T1098.003