detect-entra-role-grant-escalation

Attack pattern

This detector covers one narrow Entra privilege-escalation slice:

• Add app role assignment to service principal

That event family represents granting an application permission / app role to a service principal. In ATT&CK terms, that maps cleanly to T1098.003 Additional Cloud Roles.

This slice intentionally does not cover:

• service-principal credential additions
• federated identity credentials
• directory role assignments
• Conditional Access changes
• every Entra administrative mutation