Detectionmediumtest

Azure New CloudShell Created

Identifies when a new cloudshell is created inside of Azure portal.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Austin SongerCreated Tue Sep 21Updated Tue Aug 2372af37e2-ec32-47dc-992b-bc288a2708cbcloud

Log Source

Azureactivitylogs

ProductAzure← raw: azure

Serviceactivitylogs← raw: activitylogs

Detection Logic

detection:
    selection:
        operationName: MICROSOFT.PORTAL/CONSOLES/WRITE
    condition: selection

False Positives

A new cloudshell may be created by a system administrator.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

72af37e2-ec32-47dc-992b-bc288a2708cb

Status

test

Level

medium

Type

Detection

Created

Tue Sep 21

Modified

Tue Aug 23

Author

Path

rules/cloud/azure/activity_logs/azure_new_cloudshell_created.yml

Raw Tags

attack.executionattack.t1059