Entra ID User Added to Global Administrator Role
This rule detects when a user is added to an administrative role within Microsoft Entra ID (formerly Azure AD). It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product event type is 'Add member to role', and the product name is 'Azure AD Directory Audit'. The rule is configured to trigger when a user is assigned to a role with the TemplateId '62e90394-69f5-4237-9190-012177145e10', which corresponds to the Global Administrator role in Azure AD. This activity is sensitive and warrants validation due to the high privileges associated with administrative roles.
YARA-L
