Detectionmediumtest

Number Of Resource Creation Or Deployment Activities

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

sawwinnnaungCreated Thu May 07Updated Wed Oct 11d2d901db-7a75-45a1-bc39-0cbf00812192cloud

Log Source

Azureactivitylogs

ProductAzure← raw: azure

Serviceactivitylogs← raw: activitylogs

Detection Logic

detection:
    keywords:
        - Microsoft.Compute/virtualMachines/write
        - Microsoft.Resources/deployments/write
    condition: keywords

False Positives

Valid change

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

d2d901db-7a75-45a1-bc39-0cbf00812192

Status

test

Level

medium

Type

Detection

Created

Thu May 07

Modified

Wed Oct 11

Author

Path

rules/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml

Raw Tags

attack.privilege-escalationattack.persistenceattack.t1098