Azure PIM: Alert for Roles Assigned Outside Privileged Identity Management

Detects Azure PIM risk events indicating privileged role assignments were made outside PIM.

FreeUnreviewedSigmahighv1

azure-pim-alert-for-roles-assigned-outside-privileged-identity-management-b1bc08d1

title: "Azure PIM: Alert for Roles Assigned Outside Privileged Identity Management"
id: 26fc8a4a-8fdb-4701-ad9a-e4d1717bc0a0
status: test
description: This rule flags risk events where privileged role assignments occur outside of Privileged Identity Management (PIM), matching a specific alert configuration event type. Attackers may bypass PIM to persist access or avoid PIM-based controls and approvals. It relies on Azure PIM telemetry that records the riskEventType value for roles assigned outside PIM.
references:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-assigned-outside-of-privileged-identity-management
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/privileged_identity_management/azure_pim_role_assigned_outside_of_pim.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-14
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: azure
  service: pim
detection:
  selection:
    riskEventType: rolesAssignedOutsidePrivilegedIdentityManagementAlertConfiguration
  condition: selection
falsepositives:
  - Investigate where users are being assigned privileged roles outside of Privileged Identity Management and prohibit future assignments from there.
level: high
license: DRL-1.1
related:
  - id: b1bc08d1-8224-4758-a0e6-fbcfc98c73bb
    type: derived

What it detects

This rule flags risk events where privileged role assignments occur outside of Privileged Identity Management (PIM), matching a specific alert configuration event type. Attackers may bypass PIM to persist access or avoid PIM-based controls and approvals. It relies on Azure PIM telemetry that records the riskEventType value for roles assigned outside PIM.

Known false positives

Investigate where users are being assigned privileged roles outside of Privileged Identity Management and prohibit future assignments from there.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.