Roles Are Not Being Used
Identifies when a user has been assigned a privilege role and are not using that role.
Sigma rule (View on GitHub)
1title: Roles Are Not Being Used
2id: 8c6ec464-4ae4-43ac-936a-291da66ed13d
3status: experimental
4description: Identifies when a user has been assigned a privilege role and are not using that role.
5references:
6 - https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts#administrators-arent-using-their-privileged-roles
7author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
8date: 2023/09/14
9tags:
10 - attack.t1078
11 - attack.persistence
12 - attack.privilege_escalation
13logsource:
14 product: azure
15 service: pim
16detection:
17 selection:
18 riskEventType: 'redundantAssignmentAlertIncident'
19 condition: selection
20falsepositives:
21 - Investigate if potential generic account that cannot be removed.
22level: high
References
Related rules
- Invalid PIM License
- Roles Activated Too Frequently
- Roles Activation Doesn't Require MFA
- Roles Assigned Outside PIM
- Stale Accounts In A Privileged Role