Too Many Global Admins
Identifies an event where there are there are too many accounts assigned the Global Administrator role.
Sigma rule (View on GitHub)
1title: Too Many Global Admins
2id: 7bbc309f-e2b1-4eb1-8369-131a367d67d3
3status: experimental
4description: Identifies an event where there are there are too many accounts assigned the Global Administrator role.
5references:
6 - https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts#there-are-too-many-global-administrators
7author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
8date: 2023/09/14
9tags:
10 - attack.t1078
11 - attack.persistence
12 - attack.privilege_escalation
13logsource:
14 product: azure
15 service: pim
16detection:
17 selection:
18 riskEventType: 'tooManyGlobalAdminsAssignedToTenantAlertIncident'
19 condition: selection
20falsepositives:
21 - Investigate if threshold setting in PIM is too low.
22level: high
References
Related rules
- Invalid PIM License
- Roles Activated Too Frequently
- Roles Activation Doesn't Require MFA
- Roles Are Not Being Used
- Roles Assigned Outside PIM