privileged_identity_management | Detection.FYI

Invalid PIM License

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

Read More
Roles Activated Too Frequently

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when the same privilege role has multiple activations by the same user.

Read More
Roles Activation Doesn't Require MFA

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role can be activated without performing mfa.

Read More
Roles Are Not Being Used

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a user has been assigned a privilege role and are not using that role.

Read More
Roles Assigned Outside PIM

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read More
Stale Accounts In A Privileged Role

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies when an account hasn't signed in during the past n number of days.

Read More
Too Many Global Admins

Aug 12, 2024 · attack.t1078 attack.persistence attack.privilege-escalation ·
Share on:

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Read More