Entra ID: Recently Created User Assigned Entra ID Role
This rule detects a sequence of events where a new user account is created in Entra ID (formerly Azure AD) and then, shortly after, that same user is assigned an administrative-level role. This behavior can indicate an attacker establishing persistence or escalating privileges by creating a new account and immediately granting it high-level access.
YARA-L
