Detect PIM elevation with user risk

Group by: UserPrincipalName
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

When an account with eligible roles in Entra ID is compromised, the attacker will probably escalate their privileges via Microsoft PIM. With this rule you can detect when a risky user is elevating their privileges with PIM.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism

References

https://hybridbrothers.com/

Telemetry coverage

Provider	Record / event type
Microsoft Defender for Endpoint	`CloudAppEvents` action `any`: Cloud app activity
Entra-AuditLogs	any: Entra ID audit event (any operation)

Rule body

AuditLogs
| where TimeGenerated > ago(1h)
| where OperationName contains "PIM activation" and OperationName contains "completed"
| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
| join kind=inner (AADUserRiskEvents | where TimeGenerated > ago(1d)) on UserPrincipalName

CloudAppEvents
| where TimeGenerated > ago(1h)
| where ActionType == "Add member to role."
| extend UserPrincipalName = tostring(RawEventData.ObjectId)
| join kind=inner (AADUserRiskEvents | where TimeGenerated > ago(1d)) on UserPrincipalName

Stages and Predicates

Stage 1: `source`

AuditLogs

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `where`

| where OperationName contains "PIM activation" and OperationName contains "completed"

Stage 4: `extend`

| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)

Stage 5: `join`

| join kind=inner (AADUserRiskEvents | where TimeGenerated > ago(1d)) on UserPrincipalName

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`OperationName`	contains	`PIM activation` `completed`	`field:"OperationName" kind:contains`

Output fields

These fields are emitted when the rule matches.

Field	Source
`UserPrincipalName`	`extend`