Rules Contributing to Microsoft Entra PIM Setting Changed Alert

The following rules are used to identify suspicious Microsoft Entra PIM setting changed. Any one or more of these will trigger the Microsoft Entra PIM Setting Changed Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Changes To PIM Settings

Detects when changes are made to PIM roles

More details

Rule ID

azure_41

Query

{'selection': {'properties_message': 'Update role setting in PIM'}, 'condition': 'selection'}

Log Source

Stellar Cyber Microsoft Entra Events configured.

Rule Source

SigmaHQ,db6c06c4-bf3b-421c-aa88-15672b88c743

Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'

Tactics, Techniques, and Procedures

PRIVILEGE_ESCALATION, T1078.004

References

N/A

Severity

Suppression Logic Based On

initiatedBy.user.id
initiatedBy.app.servicePrincipalId
stellar.rule_id

Additional Information

Maturity	Creation Date	Risk Level	False Positives
experimental	2022/08/09	high	Legit administrative PIM setting configuration changes

PIM Alert Setting Changes To Disabled

Detects when PIM alerts are set to disabled.