All Detections

Privilege Escalation to Global Admin

avatar
Gurpreet Suhi@gsuhi
updated Mar 5, 2026200244

The below Sentinel KQL analytics rule is able to detect potential privilege escalation to Global Admin role via compromised service principal

Microsoft Sentinel (KQL)