azure entra ID escalation

[jbfeldman-dd]

What does this PR do?

• Creates a new attack technique azure.privilege-escalation.root-user-access-administrator. This is when a global administrator elevates themselves to have User Access Administrator over all subscriptions and management groups in the tenant scope. This is a permission that should be rarely invoked in normal circumstances, and can be used to pivot from Entra ID access to compromising Azure resources
• This technique contains no warmups as no resources are required. This action can only be performed on one's own account, not on another. It assumes the user is a Global Administrator with at least one subscription in tenant scope

Motivation

• An easy way to test a detection rule I want to write ;)

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up

[jbfeldman-dd]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc827c241e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[christophetd]

Tested and works great, thanks! Pushed some small docs fixes in f6e3419 too