Roles Assigned Outside PIM — Detection Rule

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

Read the full analysis on IntelFusions