Azure PIM Role Activated Too Frequently (Sequential Activation Renewals)

Alerts when Azure PIM logs sequential activation renewals for the same role by the same user.

FreeUnreviewedSigmahighv1

azure-pim-role-activated-too-frequently-sequential-activation-renewals-645fd80d

title: Azure PIM Role Activated Too Frequently (Sequential Activation Renewals)
id: 4466f17e-c405-4f2a-9286-006c0c70d55c
status: test
description: This rule flags instances where Azure Privileged Identity Management (PIM) reports multiple sequential activation renewals for the same privilege role by the same user. Frequent renewals can indicate an attacker attempting to sustain elevated access while evading oversight or operating within short-lived activation windows. Detection relies on PIM risk events where the riskEventType is set to sequentialActivationRenewalsAlertIncident.
references:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/privileged_identity_management/azure_pim_role_frequent_activation.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-14
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: azure
  service: pim
detection:
  selection:
    riskEventType: sequentialActivationRenewalsAlertIncident
  condition: selection
falsepositives:
  - Investigate where if active time period for a role is set too short.
level: high
license: DRL-1.1
related:
  - id: 645fd80d-6c07-435b-9e06-7bc1b5656cba
    type: derived

What it detects

This rule flags instances where Azure Privileged Identity Management (PIM) reports multiple sequential activation renewals for the same privilege role by the same user. Frequent renewals can indicate an attacker attempting to sustain elevated access while evading oversight or operating within short-lived activation windows. Detection relies on PIM risk events where the riskEventType is set to sequentialActivationRenewalsAlertIncident.

Known false positives

Investigate where if active time period for a role is set too short.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.