Azure PIM Alert Disablement in Audit Logs

Flags Azure audit log events where PIM alerts are disabled (message: "Disable PIM Alert").

FreeUnreviewedSigmahighv1

azure-pim-alert-disablement-in-audit-logs-aeaef14c

title: Azure PIM Alert Disablement in Audit Logs
id: 3cdb1de9-36ca-4a7e-91ec-671eb2b32ba2
status: test
description: This rule flags audit log events where a user disables Privileged Identity Management (PIM) alerts, indicated by the message "Disable PIM Alert." Disabling PIM alerts can reduce visibility into privileged role activity and may help an attacker evade detection during ongoing or subsequent access. The detection relies on Azure audit log telemetry captured in audit logs.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_pim_alerts_disabled.yml
author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-08-09
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Disable PIM Alert
  condition: selection
falsepositives:
  - Administrator disabling PIM alerts as an active choice.
level: high
license: DRL-1.1
related:
  - id: aeaef14c-e5bf-4690-a9c8-835caad458bd
    type: derived

What it detects

This rule flags audit log events where a user disables Privileged Identity Management (PIM) alerts, indicated by the message "Disable PIM Alert." Disabling PIM alerts can reduce visibility into privileged role activity and may help an attacker evade detection during ongoing or subsequent access. The detection relies on Azure audit log telemetry captured in audit logs.

Known false positives

Administrator disabling PIM alerts as an active choice.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.