Azure PIM Role Activation Without MFA Alert (noMfaOnRoleActivationAlertIncident)

Alerts when Azure PIM signals role activation occurred without MFA.

FreeUnreviewedSigmahighv1

azure-pim-role-activation-without-mfa-alert-nomfaonroleactivationalertincident-94a66f46

title: Azure PIM Role Activation Without MFA Alert (noMfaOnRoleActivationAlertIncident)
id: d93768c9-7ecd-4f28-ab05-5371a296bbab
status: test
description: This rule flags Azure Privileged Identity Management events where a privileged role activation is initiated without completing multi-factor authentication (MFA). Attackers may exploit MFA gaps to activate elevated privileges stealthily and then perform persistence or privilege escalation. It relies on Azure PIM telemetry carrying the specific riskEventType value indicating no MFA on role activation.
references:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-dont-require-multi-factor-authentication-for-activation
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/privileged_identity_management/azure_pim_role_no_mfa_required.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-14
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: azure
  service: pim
detection:
  selection:
    riskEventType: noMfaOnRoleActivationAlertIncident
  condition: selection
falsepositives:
  - Investigate if user is performing MFA at sign-in.
level: high
license: DRL-1.1
related:
  - id: 94a66f46-5b64-46ce-80b2-75dcbe627cc0
    type: derived

What it detects

This rule flags Azure Privileged Identity Management events where a privileged role activation is initiated without completing multi-factor authentication (MFA). Attackers may exploit MFA gaps to activate elevated privileges stealthily and then perform persistence or privilege escalation. It relies on Azure PIM telemetry carrying the specific riskEventType value indicating no MFA on role activation.

Known false positives

Investigate if user is performing MFA at sign-in.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.