Detectionhightest

Too Many Global Admins

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Mark Morowczynski, Gloria LeeCreated Thu Sep 147bbc309f-e2b1-4eb1-8369-131a367d67d3cloud

Log Source

Azurepim

ProductAzure← raw: azure

Servicepim← raw: pim

Detection Logic

detection:
    selection:
        riskEventType: 'tooManyGlobalAdminsAssignedToTenantAlertIncident'
    condition: selection

False Positives

Investigate if threshold setting in PIM is too low.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

7bbc309f-e2b1-4eb1-8369-131a367d67d3

Status

test

Level

high

Type

Detection

Created

Thu Sep 14

Author

Path

rules/cloud/azure/privileged_identity_management/azure_pim_too_many_global_admins.yml

Raw Tags

attack.initial-accessattack.defense-evasionattack.t1078attack.persistenceattack.privilege-escalation