Azure Machine Learning Write Operations

Back


Id	68c89998-8052-4c80-a1f6-9d81060b6d57
Rulename	Azure Machine Learning Write Operations
Description	Shows the most prevalent users who perform write operations on Azure Machine Learning resources. List the common source IP address for each of those accounts. If an operation is not from those IP addresses, it may be worthy of investigation.
Severity	Low
Tactics	InitialAccess Execution Impact
Techniques	T1078 T1059 T1496
Required data connectors	AzureActivity
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Activity/Analytic Rules/Machine_Learning_Creation.yaml
Version	1.0.0
Arm template	68c89998-8052-4c80-a1f6-9d81060b6d57.json

KQL

AzureActivity
| where ResourceProviderValue == "MICROSOFT.MACHINELEARNINGSERVICES"  // Filter activities related to Microsoft Machine Learning Services
| extend SCOPE = tostring(parse_json(Authorization).scope)  // Parse Authorization scope as string
| extend subname = split(Hierarchy, "/")  // Split Hierarchy to extract Subscription Name and ID
| extend ['Subscription Name'] = subname[-2], ['Subscription ID'] = subname[-1]  // Extract Subscription Name and ID
| extend Properties = parse_json(Properties)  // Parse Properties as JSON
| extend Properties_entity = tostring(Properties.entity)  // Cast Properties.entity to string
| where isnotempty(Properties_entity)  // Filter activities where Properties.entity is not empty
// | where Properties_entity contains "deepseek"  // Filter activities where Properties.entity contains "deepseek"
| where OperationNameValue contains "write"  // Filter activities where OperationNameValue contains "write"
| where OperationNameValue !contains "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE"  // Exclude role assignments
| extend LLM = tostring(split(Properties_entity, "/")[-1])  // Extract the last segment of Properties_entity and cast it to string
| distinct TimeGenerated, tostring(['Subscription Name']), ResourceGroup, tostring(['Subscription ID']), Caller, CallerIpAddress, OperationNameValue, LLM, _ResourceId  // Select distinct relevant fields for output

YAML

status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure Activity/Analytic Rules/Machine_Learning_Creation.yaml
triggerOperator: gt
query: |
  AzureActivity
  | where ResourceProviderValue == "MICROSOFT.MACHINELEARNINGSERVICES"  // Filter activities related to Microsoft Machine Learning Services
  | extend SCOPE = tostring(parse_json(Authorization).scope)  // Parse Authorization scope as string
  | extend subname = split(Hierarchy, "/")  // Split Hierarchy to extract Subscription Name and ID
  | extend ['Subscription Name'] = subname[-2], ['Subscription ID'] = subname[-1]  // Extract Subscription Name and ID
  | extend Properties = parse_json(Properties)  // Parse Properties as JSON
  | extend Properties_entity = tostring(Properties.entity)  // Cast Properties.entity to string
  | where isnotempty(Properties_entity)  // Filter activities where Properties.entity is not empty
  // | where Properties_entity contains "deepseek"  // Filter activities where Properties.entity contains "deepseek"
  | where OperationNameValue contains "write"  // Filter activities where OperationNameValue contains "write"
  | where OperationNameValue !contains "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE"  // Exclude role assignments
  | extend LLM = tostring(split(Properties_entity, "/")[-1])  // Extract the last segment of Properties_entity and cast it to string
  | distinct TimeGenerated, tostring(['Subscription Name']), ResourceGroup, tostring(['Subscription ID']), Caller, CallerIpAddress, OperationNameValue, LLM, _ResourceId  // Select distinct relevant fields for output  
requiredDataConnectors:
- dataTypes:
  - AzureActivity
  connectorId: AzureActivity
tactics:
- InitialAccess
- Execution
- Impact
name: Azure Machine Learning Write Operations
relevantTechniques:
- T1078
- T1059
- T1496
severity: Low
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: Caller
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: CallerIpAddress
  entityType: IP
- fieldMappings:
  - identifier: ResourceId
    columnName: _ResourceId
  entityType: AzureResource
queryFrequency: 1d
description: |
    'Shows the most prevalent users who perform write operations on Azure Machine Learning resources. List the common source IP address for each of those accounts. If an operation is not from those IP addresses, it may be worthy of investigation.'
eventGroupingSettings:
  aggregationKind: SingleAlert
triggerThreshold: 0
queryPeriod: 1d
version: 1.0.0
kind: Scheduled
id: 68c89998-8052-4c80-a1f6-9d81060b6d57

ARM