<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-privileged-access-management
description: >-
  Implement and audit Privileged Access Management solutions including just-in-time
  access, credential vaulting, session recording, privilege elevation workflows,
  and break-glass procedures using CyberArk, HashiCorp Vault, and Azure PIM.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - pam
  - privileged-access
  - cyberark
  - hashicorp-vault
  - azure-pim
  - jit-access
  - credential-vaulting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.002"]
---

# Implementing Privileged Access Management

## Overview

Privileged Access Management (PAM) controls, monitors, and audits elevated access
to critical systems. Implementation covers credential vaulting with automatic rotation,
just-in-time (JIT) privilege elevation, session recording for forensic review,
break-glass emergency access procedures, and integration with SIEM for anomaly
detection on privileged sessions.

Mode: `[MODE: ARCHITECT]` for PAM design; `[MODE: BLUE]` for PAM auditing.

MITRE ATT&CK: T1078.002 (Valid Accounts: Domain Accounts), T1098 (Account Manipulation)

## Prerequisites

| Requirement | Details |
|---|---|
| PAM platform (CyberArk, HashiCorp Vault, Azure PIM, or BeyondTrust) | Required |
| Active Directory with tiered admin model | Required |
| SIEM integration for privileged session monitoring | Required |
| Python 3.10+ with `hvac` (Vault), `azure-identity`, `requests` | Required |

## Key Concepts

### PAM Architecture

```
┌─────────────────────────────────────┐
│         PAM Control Plane           │
├──────────┬──────────┬───────────────┤
│ Credential│ Session  │ Approval     │
│ Vault     │ Manager  │ Workflow     │
├──────────┼──────────┼───────────────┤
│ Auto-     │ Recording│ JIT          │
│ Rotation  │ & Replay │ Elevation    │
├──────────┴──────────┴───────────────┤
│         Audit & Analytics           │
└─────────────────────────────────────┘
```

### JIT Access Workflow

```bash
# Azure PIM: Activate eligible role
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleRequests" \
  --body '{
    "action": "SelfActivate",
    "principalId": "USER_ID",
    "roleDefinitionId": "ROLE_ID",
    "directoryScopeId": "/",
    "justification": "Incident response - INC-2026-0317",
    "scheduleInfo": {
      "startDateTime": "2026-03-17T19:00:00Z",
      "expiration": {"type": "afterDuration", "duration": "PT2H"}
    }
  }'
```

### HashiCorp Vault Credential Management

```bash
# Enable secrets engine
vault secrets enable -path=ad ad
vault write ad/config \
  binddn="cn=vault,ou=service,dc=target,dc=com" \
  bindpass="BIND_PASSWORD" \
  url="ldaps://dc.target.com"

# Configure password rotation
vault write ad/roles/svc-backup \
  service_account_name="svc-backup@target.com" \
  ttl=1h

# Checkout credential (JIT)
vault read ad/creds/svc-backup

# Dynamic database credentials
vault secrets enable database
vault write database/roles/app-readonly \
  db_name=mydb \
  creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; GRANT SELECT ON app.* TO '{{name}}'@'%';" \
  default_ttl=1h max_ttl=24h
```

## Workflow

### Step 1: Inventory Privileged Accounts

```bash
node scripts/agent.js --domain target.com --inventory --output /tmp/pam_inventory.json

# PowerShell: Find privileged accounts
Get-ADGroupMember -Identity "Domain Admins" -Recursive | Select-Object Name, SamAccountName
Get-ADGroupMember -Identity "Enterprise Admins" -Recursive | Select-Object Name, SamAccountName
```

### Step 2: Audit PAM Configuration

```bash
node scripts/agent.js --vault-addr https://vault.target.com --audit --output /tmp/pam_audit.json
```

### Step 3: Validate Controls

```bash
# Verify credential rotation
vault read sys/mounts/ad/tune
vault list ad/roles

# Verify JIT activation logs
az monitor activity-log list --resource-type Microsoft.Authorization/roleAssignments
```

## Detection

```yaml
title: Privileged Access Management Detection
id: 82197332-2089-471b-ad73-5d6abcfc8192
status: experimental
description: Detects suspicious activity related to implementing privileged access management techniques in identity access management context
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventType: authentication
    Status: failure
  condition: selection
level: medium
tags:
  - attack.t1078.002
  - attack.credential_access
falsepositives:
  - Automated password rotation by privileged access management tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Privileged Access Management Detection | windows/authentication | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078.002 |

## Verification

- [ ] All privileged credentials stored in vault (no local admin passwords)
- [ ] Credential rotation enforced (≤90 days for service accounts, ≤24h for JIT)
- [ ] JIT access configured with maximum activation duration ≤4 hours
- [ ] Session recording enabled for all privileged sessions
- [ ] Break-glass accounts exist with sealed credentials and tamper alerting
- [ ] Approval workflow required for Tier 0 access
- [ ] SIEM alerts on privileged session anomalies
- [ ] Quarterly access review for all permanent privileged role assignments

## References

- [NIST SP 800-53 AC-2 — Account Management](https://csf.tools/reference/nist-sp-800-53/r5/ac/ac-2/)
- [CIS Controls v8 — Control 6: Access Control Management](https://www.cisecurity.org/controls/v8)
- [HashiCorp Vault Documentation](https://developer.hashicorp.com/vault/docs)
- [Microsoft — Privileged Identity Management](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/)
