Add Role Definition
Azure
Add Role Definition
Event
Creates a new custom Azure RBAC role definition with specified allowed and denied actions.
Security Context
- Account manipulation is a primary persistence technique, allowing adversaries to maintain access through modified permissions or credentials.
Log Source
Azure Activity Log
Sample Event
Adversarial. Compromised user draco@fantasticlogs.cloud (now User Access Administrator at root via the elevateAccess chain) creates a custom RBAC role definition named BackupReader with seemingly benign read actions but an embedded wildcard Microsoft.Compute/snapshots/* permission that lets the role’s holders snapshot any disk. The role’s assignableScopes is set to the production subscription. Stealth-of-design: the role looks like a least-privilege backup helper but actually grants disk-content theft capability via snapshot.
{ "authorization": { "action": "Microsoft.Authorization/roleDefinitions/write", "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Authorization/roleDefinitions/50000000-0000-4000-8000-000001101001" }, "caller": "draco@fantasticlogs.cloud", "channels": "Operation", "claims": { "aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/", "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "ipaddr": "203.0.113.66", "name": "Draco Malfoy", "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814" }, "correlationId": "90000000-0000-4000-8000-000001101001", "description": "", "eventDataId": "90000000-0000-4000-8000-000001101010", "eventName": { "value": "EndRequest", "localizedValue": "End request" }, "category": { "value": "Administrative", "localizedValue": "Administrative" }, "eventTimestamp": "2026-04-15T19:02:14.7382194Z", "id": "/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Authorization/roleDefinitions/50000000-0000-4000-8000-000001101001/events/90000000-0000-4000-8000-000001101010/ticks/638798144347382194", "level": "Informational", "operationId": "90000000-0000-4000-8000-000001101011", "operationName": { "value": "Microsoft.Authorization/roleDefinitions/write", "localizedValue": "Create role definition" }, "resourceGroupName": "", "resourceProviderName": { "value": "Microsoft.Authorization", "localizedValue": "Microsoft.Authorization" }, "resourceType": { "value": "Microsoft.Authorization/roleDefinitions", "localizedValue": "Microsoft.Authorization/roleDefinitions" }, "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Authorization/roleDefinitions/50000000-0000-4000-8000-000001101001", "status": { "value": "Succeeded", "localizedValue": "Succeeded" }, "subStatus": { "value": "Created", "localizedValue": "Created (HTTP Status Code: 201)" }, "submissionTimestamp": "2026-04-15T19:02:15.4192835Z", "subscriptionId": "20000000-0000-4000-8000-000000000001", "tenantId": "10000000-0000-4000-8000-000000000001", "properties": { "statusCode": "Created", "serviceRequestId": null, "responseBody": "{\"properties\":{\"roleName\":\"BackupReader\",\"description\":\"Read-only backup operator role\",\"assignableScopes\":[\"/subscriptions/20000000-0000-4000-8000-000000000001\"],\"permissions\":[{\"actions\":[\"Microsoft.Compute/disks/read\",\"Microsoft.Compute/snapshots/*\",\"Microsoft.Storage/storageAccounts/read\"],\"notActions\":[],\"dataActions\":[],\"notDataActions\":[]}],\"createdOn\":\"2026-04-15T19:02:14.6173821Z\",\"updatedOn\":\"2026-04-15T19:02:14.6173821Z\",\"createdBy\":\"30000000-0000-4000-8000-001010011010\",\"updatedBy\":\"30000000-0000-4000-8000-001010011010\",\"type\":\"CustomRole\"},\"id\":\"/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Authorization/roleDefinitions/50000000-0000-4000-8000-000001101001\",\"type\":\"Microsoft.Authorization/roleDefinitions\",\"name\":\"50000000-0000-4000-8000-000001101001\"}", "requestbody": "{\"properties\":{\"roleName\":\"BackupReader\",\"description\":\"Read-only backup operator role\",\"type\":\"CustomRole\",\"permissions\":[{\"actions\":[\"Microsoft.Compute/disks/read\",\"Microsoft.Compute/snapshots/*\",\"Microsoft.Storage/storageAccounts/read\"],\"notActions\":[]}],\"assignableScopes\":[\"/subscriptions/20000000-0000-4000-8000-000000000001\"]}}", "eventCategory": "Administrative", "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Authorization/roleDefinitions/50000000-0000-4000-8000-000001101001", "message": "Microsoft.Authorization/roleDefinitions/write", "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001" }, "relatedEvents": [], "httpRequest": { "clientRequestId": "90000000-0000-4000-8000-000001101100", "clientIpAddress": "203.0.113.66", "method": "PUT", "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/providers/Microsoft.Authorization/roleDefinitions/50000000-0000-4000-8000-000001101001?api-version=2022-04-01" }, "identity": null}MITRE ATT&CK Mapping
Tactics: Privilege Escalation Persistence
Techniques:
- T1098 — Account Manipulation — Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include accoun...