Azure PIM: Redundant Privileged Role Assignments Not Being Used

title: "Azure PIM: Redundant Privileged Role Assignments Not Being Used"
id: 0a5fb671-898f-4ba0-a57f-d5eedbd1a5e7
status: test
description: This rule flags cases where Azure Privileged Identity Management reports a redundant assignment alert incident indicating a user has been assigned a privileged role that is not being used. Attackers can rely on over-provisioned privileged access to blend in or maintain persistence without activating the role. The detection relies on PIM telemetry events that provide the riskEventType value for redundant assignment alerts tied to privileged role usage.
references:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#administrators-arent-using-their-privileged-roles
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/privileged_identity_management/azure_pim_role_not_used.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-14
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: azure
  service: pim
detection:
  selection:
    riskEventType: redundantAssignmentAlertIncident
  condition: selection
falsepositives:
  - Investigate if potential generic account that cannot be removed.
level: high
license: DRL-1.1
related:
  - id: 8c6ec464-4ae4-43ac-936a-291da66ed13d
    type: derived