sigmahighHunting

PIM Alert Setting Changes To Disabled

Detects when PIM alerts are set to disabled.

MITRE ATT&CK

initial-accessdefense-evasionpersistenceprivilege-escalation

Detection Query

selection:
  properties.message: Disable PIM Alert
condition: selection

Author

Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'

Created

2022-08-09

Data Sources

azureauditlogs

Platforms

azure

References

https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment

Tags

attack.initial-accessattack.defense-evasionattack.persistenceattack.privilege-escalationattack.t1078

Raw Content

title: PIM Alert Setting Changes To Disabled
id: aeaef14c-e5bf-4690-a9c8-835caad458bd
status: test
description: Detects when PIM alerts are set to disabled.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
date: 2022-08-09
tags:
    - attack.initial-access
    - attack.defense-evasion
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1078
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message: Disable PIM Alert
    condition: selection
falsepositives:
    - Administrator disabling PIM alerts as an active choice.
level: high