Silk Typhoon PAM Platform Abuse: Privileged Account Vault Access Anomaly
Detects anomalous access to Privileged Access Management (PAM) platforms (e.g., CyberArk, BeyondTrust, Delinea, HashiCorp Vault, Thycotic, ARCON PAM). The rule identifies successful sign-ins occurring outside typical business hours (7 AM to 7 PM) that also exhibit either a high volume of sign-ins (more than 5 per hour per user/app) or access from multiple new IP addresses (more than 2 unique IPs per hour per user/app). This behavior is indicative of potential abuse of privileged accounts, possibly by threat actors like Silk Typhoon (HAFNIUM).
Microsoft Sentinel (KQL)
