Entra ID Privileged Identity Management - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/entra-id-privileged-identity-management/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000Entra ID Privileged Identity Management (PIM) Role Modifiedhttps://feed.craftedsignal.io/briefs/2024-01-entra-id-pim-role-modification/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-entra-id-pim-role-modification/Attackers may modify Entra ID Privileged Identity Management (PIM) roles to persist in the environment and weaken security controls, potentially leading to privilege escalation and unauthorized access.Azure Active Directory (AD) Privileged Identity Management (PIM) is a service that organizations use to manage, control, and monitor access to important resources. PIM manages built-in Azure resource roles like Global Administrator and Application Administrator. Attackers with sufficient privileges may modify PIM role assignments or settings to weaken the target's security posture or grant themselves persistent access. This activity can be indicative of prior compromise or lateral movement within the Azure environment. This activity could allow the attacker to escalate privileges or maintain access to critical resources even after initial compromise is remediated.

Attack Chain

  1. Initial Access: An attacker compromises an account with existing privileges in the Azure environment, potentially through credential theft or phishing.
  2. Privilege Escalation: The attacker leverages the compromised account's permissions to gain access to the Azure Active Directory Privileged Identity Management (PIM) service.
  3. Discovery: The attacker enumerates existing PIM roles and settings to identify potential targets for modification.
  4. Modify Role Setting: The attacker modifies a PIM role's settings, such as the approval requirements, activation duration, or notification settings, to weaken security controls.
  5. Assign Role: The attacker assigns a new user account (potentially controlled by the attacker) to a PIM role with elevated privileges, such as Global Administrator or Application Administrator.
  6. Activate Role: The attacker activates the newly assigned role for the attacker-controlled account.
  7. Persistence: The attacker maintains persistent access to the Azure environment through the newly acquired role, bypassing standard access controls.
  8. Impact: The attacker leverages the elevated privileges to access sensitive data, modify system configurations, or disrupt services.

Impact

Successful modification of Entra ID PIM roles can grant attackers persistent, elevated privileges within the Azure environment. This can lead to unauthorized access to sensitive data, modification of critical system configurations, and disruption of services. The impact can range from data breaches and financial loss to complete system compromise, depending on the scope and nature of the affected roles.

Recommendation

  • Deploy the Sigma rule "Entra ID PIM Role Modified" to detect unauthorized modifications to PIM role settings based on the azure.auditlogs.operation_name:"Update role setting in PIM" event.
  • Investigate any alerts generated by the Sigma rule, focusing on identifying the user account that performed the action and validating the legitimacy of the changes.
  • Enable multi-factor authentication for all users, especially those with privileged roles, to prevent credential theft and unauthorized access to the Azure environment.
  • Review and enforce the organization's change management policies for all modifications to PIM role settings to ensure that changes are properly authorized and documented.
]]>mediumadvisoryazurepersistenceprivileged-identity-management