Detectionhightest

PIM Alert Setting Changes To Disabled

Detects when PIM alerts are set to disabled.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Mark Morowczynski, Yochana HendersonCreated Tue Aug 09aeaef14c-e5bf-4690-a9c8-835caad458bdcloud

Log Source

Azureauditlogs

ProductAzure← raw: azure

Serviceauditlogs← raw: auditlogs

Detection Logic

detection:
    selection:
        properties.message: Disable PIM Alert
    condition: selection

False Positives

Administrator disabling PIM alerts as an active choice.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

aeaef14c-e5bf-4690-a9c8-835caad458bd

Status

test

Level

high

Type

Detection

Created

Tue Aug 09

Author

Path

rules/cloud/azure/audit_logs/azure_pim_alerts_disabled.yml

Raw Tags

attack.initial-accessattack.defense-evasionattack.persistenceattack.privilege-escalationattack.t1078