Azure PIM Invalid License Alert Detection

Alerts when Azure PIM reports an invalid or missing license condition for the organization.

FreeUnreviewedSigmahighv1

azure-pim-invalid-license-alert-detection-58af08eb

title: Azure PIM Invalid License Alert Detection
id: fbf402cd-2b46-4ec7-87d2-85b7a49ba85e
status: test
description: This rule flags security alerts indicating the organization has an invalid or missing license for Privileged Identity Management (PIM) in Azure. Attackers may exploit licensing and configuration gaps to reduce protections or avoid expected enforcement. The detection relies on Azure PIM telemetry that reports a risk event type of invalidLicenseAlertIncident.
references:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#the-organization-doesnt-have-microsoft-entra-premium-p2-or-microsoft-entra-id-governance
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/privileged_identity_management/azure_pim_invalid_license.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-14
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: azure
  service: pim
detection:
  selection:
    riskEventType: invalidLicenseAlertIncident
  condition: selection
falsepositives:
  - Investigate if licenses have expired.
level: high
license: DRL-1.1
related:
  - id: 58af08eb-f9e1-43c8-9805-3ad9b0482bd8
    type: derived

What it detects

This rule flags security alerts indicating the organization has an invalid or missing license for Privileged Identity Management (PIM) in Azure. Attackers may exploit licensing and configuration gaps to reduce protections or avoid expected enforcement. The detection relies on Azure PIM telemetry that reports a risk event type of invalidLicenseAlertIncident.

Known false positives

Investigate if licenses have expired.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.