Analytics BIOC
Low
✕
Azure AD PIM role settings change
An identity changed the PIM role settings.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- AzureAD Audit Log
ATT&CK tactics: Defense Evasion (TA0005) Privilege Escalation (TA0004)
ATT&CK techniques: Abuse Elevation Control Mechanism (T1548) Valid Accounts (T1078)
Attacker's goals:
An attacker can modify the PIM role settings to make it easier to acquire a privileged account.
Investigative actions:
Check what role settings have been updated. Check whether the user changing the settings is permitted to perform such actions.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Hour
1 variation:
- Suspicious Azure AD PIM role settings change Medium (parent: Low)