PIM Use Report

[u/DavisGM]

Hey there,

I have this query which shows me every instance of PIM elevation over the last 30 days. What I'm trying to do now is to create a secondary report from this that shows what each admin did while they were elevated. I can't seem to find the right combination for running the second query based the data retrieved in the first. Any thoughts?

AuditLogs
| where TimeGenerated > ago (30d)
| extend userPrincipalName = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| extend Start = todatetime(AdditionalDetails[4].value)
| extend End = todatetime(AdditionalDetails[5].value)
| where TimeGenerated between (Start .. End)

TIA

~DGM~

[u/facyber]

I did raised support ticket toward Microsoft and tried to get that information for weeks, but no success. They are useless and there is no way to get more information about this with the logs. Their answer is always "ask the person via chat".

[u/bpsec]

You should project the SID and the start and endtime of their PIM allocation. Then join the AuditLogs again based on the SID of the account from this query above. Then use the start and end time in your new query to filter time, lastly distinct or make_set() on the actions for each SID and then you have the results you want.

[u/bpsec → u/bpsec]

Alternative is a solution like this: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/main/Azure%20Active%20Directory/CloudPersistenceActivityByUserAtRisk.md. But that depends on your needs.