Analytic rule catalog
[AzureSubscription] Suspicious Azure VM Run Command Execution Detected
Back
| Id | 6fa564ac-dfb7-4753-a49b-5fc919866c28 |
| Rulename | [AzureSubscription] Suspicious Azure VM Run Command Execution Detected |
| Description | Detects Azure VM Run Command execution correlated with unusual sign-in behavior from UEBA. This can indicate administrative abuse or post-compromise activity. |
| Severity | High |
| Tactics | LateralMovement CredentialAccess |
| Techniques | T1570 T1212 |
| Required data connectors | AzureActivity |
| Kind | Scheduled |
| Query frequency | 1d |
| Query period | 2d |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BAzureSubscription%5D%20Suspicious%20Azure%20VM%20Run%20Command%20Execution%20Detected.yaml |
| Version | 1.0.0 |
| Arm template | 6fa564ac-dfb7-4753-a49b-5fc919866c28.json |
AzureActivity
// Isolate run command actions
| where OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION"
// Confirm that the operation impacted a virtual machine
| where Authorization has "virtualMachines"
// Each runcommand operation consists of three events when successful, Started, Accepted (or Rejected), Successful (or Failed).
| summarize
StartTime=min(TimeGenerated),
EndTime=max(TimeGenerated),
max(CallerIpAddress),
make_list(ActivityStatusValue)
by CorrelationId, Authorization, Caller, OperationNameValue
// Limit to Run Command executions that Succeeded
| where list_ActivityStatusValue has_any ("Success", "Succeeded")
// Extract data from the Authorization field
| extend Authorization_d = parse_json(Authorization)
| extend Scope = Authorization_d.scope
| extend Scope_s = split(Scope, "/")
| extend Subscription = tostring(Scope_s[2])
| extend VirtualMachineName = tostring(Scope_s[-1])
| project
StartTime,
EndTime,
Subscription,
VirtualMachineName,
CorrelationId,
Caller,
CallerIpAddress=max_CallerIpAddress,
OperationNameValue
// Create a join key using the Caller (UPN)
| extend joinkey = tolower(Caller)
// Join the Run Command actions to UEBA data
| join kind = inner (
BehaviorAnalytics
// We are specifically interested in unusual logins
| where EventSource == "Azure AD" and ActivityInsights.ActionUncommonlyPerformedByUser == "True"
| project
UEBAEventTime=TimeGenerated,
UEBAActionType=ActionType,
UserPrincipalName,
UEBASourceIPLocation=SourceIPLocation,
UEBAActivityInsights=ActivityInsights,
UEBAUsersInsights=UsersInsights
| where isnotempty(UserPrincipalName) and isnotempty(UEBASourceIPLocation)
| extend joinkey = tolower(UserPrincipalName)
)
on joinkey
// Create a window around the UEBA event times, check to see if the Run Command action was performed within them
| extend UEBAWindowStart = UEBAEventTime - 1h, UEBAWindowEnd = UEBAEventTime + 6h
| where StartTime between (UEBAWindowStart .. UEBAWindowEnd)
| project
StartTime,
EndTime,
Subscription,
VirtualMachineName,
Caller,
CallerIpAddress,
UEBAEventTime,
UEBAActionType,
UEBASourceIPLocation,
UEBAActivityInsights,
UEBAUsersInsights,
OperationNameValue
| extend
AccountName = tostring(split(Caller, "@")[0]),
AccountUPNSuffix = tostring(split(Caller, "@")[1])
| extend Source_Network_IPLocation = ""
| project
Alert_Category_en = "Azure Subscription",
Alert_SubCategory_en = "Anomaly User Access Resource",
Alert_Name_en = "Suspicious Azure VM Run Command Execution Detected",
Alert_Description_en=
strcat(
"At Taiwan time: ",
format_datetime(datetime_utc_to_local(StartTime, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
", detected user ",
iff(isnotempty(Caller), Caller, "<NoCaller>"),
" in subscription ",
iff(isnotempty(Subscription), Subscription, "<NoSubscription>"),
" executed against virtual machine ",
iff(isnotempty(VirtualMachineName), VirtualMachineName, "<NoVM>"),
" successfully performed Run Command operation: ",
OperationNameValue,
". Source IP: ",
iff(isnotempty(CallerIpAddress), CallerIpAddress, "<NoIP>"),
". The user was also flagged by UEBA detection for uncommon behavior: ",
iff(isnotempty(UEBAActionType), UEBAActionType, "<NoUEBAType>"),
", source location: ",
iff(isnotempty(UEBASourceIPLocation), UEBASourceIPLocation, "<NoLocation>"),
", indicating this administrative operation has potential account abuse risk."
),
Alert_TriageStep_en=
strcat(
"1. Confirm whether user ",
iff(isnotempty(Caller), Caller, "<NoCaller>"),
" is a legitimate operator/maintainer of the VM, and check whether there is a corresponding change or maintenance ticket.",
"2. Review whether Run Command is an expected command and confirm whether it involves download, account creation, service modification, or persistence behavior.",
"3. Compare source IP ",
iff(isnotempty(CallerIpAddress), CallerIpAddress, "<NoIP>"),
" with the location flagged by UEBA ",
iff(isnotempty(UEBASourceIPLocation), UEBASourceIPLocation, "<NoLocation>"),
" to determine whether it is abnormal (VPN, uncommon location, jump server)."
),
Alert_Containment_en=
strcat(
"1. If confirmed as an unauthorized operation, immediately revoke user ",
iff(isnotempty(Caller), Caller, "<NoCaller>"),
" 's existing sign-in sessions and access tokens, and force re-authentication or suspend the account.",
"2. Temporarily remove the account's administrative permissions on the target virtual machine (such as Virtual Machine Contributor / Owner) to prevent Run Command from being executed again.",
"3. For source IP ",
iff(isnotempty(CallerIpAddress), CallerIpAddress, "<NoIP>"),
" block it or increase Conditional Access restrictions to prevent continued abuse.",
"4. Depending on the risk level, isolate the affected VM and perform cybersecurity forensics to prevent lateral movement or malicious persistence."
),
Alert_Remediation_en=
strcat(
"1. Apply the least privilege principle to all roles that can execute Run Command, and manage high-privilege accounts through PIM/JIT.",
"2. Strengthen Conditional Access policies by requiring management operations to pass MFA, device compliance, and named location checks, and block uncommon location sign-ins.",
"3. Establish real-time alerts and automated response for Run Command-related activity, such as revoking sessions, disabling accounts, and notifying SOC.",
"4. Ensure Defender for Cloud and EDR are enabled on virtual machines, and regularly audit scheduled tasks, services, and startup items on VMs to avoid malicious command remnants.",
"5. Reduce the risk of hosts being exploited again through known vulnerabilities by applying regular security patches and vulnerability updates."
),
Alert_Time_TW = datetime_utc_to_local(StartTime, "Asia/Taipei"),
Alert_Time_UTC0 = StartTime,
Event_TimeRange_Start_TW = datetime_utc_to_local(StartTime, 'Asia/Taipei'),
Event_TimeRange_End_TW = datetime_utc_to_local(EndTime, 'Asia/Taipei'),
Event_TimeRange_Start_UTC0 = StartTime,
Event_TimeRange_End_UTC0 = EndTime,
Event_Action = OperationNameValue,
//Event_Code = score,
Source_Identity_FullName = Caller,
//Source_Identity_ID = ActorID,
Source_Identity_Type = iff(Caller contains '@', "User", "Service"),
Source_Network_IPAddress = CallerIpAddress,
Source_Network_IPLocation = Source_Network_IPLocation,
Target_Device_Name = VirtualMachineName,
Target_Resource_ID = Subscription,
Target_Resource_Type = "Azure Subscription"
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BAzureSubscription%5D%20Suspicious%20Azure%20VM%20Run%20Command%20Execution%20Detected.yaml
version: 1.0.0
status: Available
requiredDataConnectors:
- dataTypes:
- AzureActivity
connectorId: AzureActivity
relevantTechniques:
- T1570
- T1212
query: |
AzureActivity
// Isolate run command actions
| where OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION"
// Confirm that the operation impacted a virtual machine
| where Authorization has "virtualMachines"
// Each runcommand operation consists of three events when successful, Started, Accepted (or Rejected), Successful (or Failed).
| summarize
StartTime=min(TimeGenerated),
EndTime=max(TimeGenerated),
max(CallerIpAddress),
make_list(ActivityStatusValue)
by CorrelationId, Authorization, Caller, OperationNameValue
// Limit to Run Command executions that Succeeded
| where list_ActivityStatusValue has_any ("Success", "Succeeded")
// Extract data from the Authorization field
| extend Authorization_d = parse_json(Authorization)
| extend Scope = Authorization_d.scope
| extend Scope_s = split(Scope, "/")
| extend Subscription = tostring(Scope_s[2])
| extend VirtualMachineName = tostring(Scope_s[-1])
| project
StartTime,
EndTime,
Subscription,
VirtualMachineName,
CorrelationId,
Caller,
CallerIpAddress=max_CallerIpAddress,
OperationNameValue
// Create a join key using the Caller (UPN)
| extend joinkey = tolower(Caller)
// Join the Run Command actions to UEBA data
| join kind = inner (
BehaviorAnalytics
// We are specifically interested in unusual logins
| where EventSource == "Azure AD" and ActivityInsights.ActionUncommonlyPerformedByUser == "True"
| project
UEBAEventTime=TimeGenerated,
UEBAActionType=ActionType,
UserPrincipalName,
UEBASourceIPLocation=SourceIPLocation,
UEBAActivityInsights=ActivityInsights,
UEBAUsersInsights=UsersInsights
| where isnotempty(UserPrincipalName) and isnotempty(UEBASourceIPLocation)
| extend joinkey = tolower(UserPrincipalName)
)
on joinkey
// Create a window around the UEBA event times, check to see if the Run Command action was performed within them
| extend UEBAWindowStart = UEBAEventTime - 1h, UEBAWindowEnd = UEBAEventTime + 6h
| where StartTime between (UEBAWindowStart .. UEBAWindowEnd)
| project
StartTime,
EndTime,
Subscription,
VirtualMachineName,
Caller,
CallerIpAddress,
UEBAEventTime,
UEBAActionType,
UEBASourceIPLocation,
UEBAActivityInsights,
UEBAUsersInsights,
OperationNameValue
| extend
AccountName = tostring(split(Caller, "@")[0]),
AccountUPNSuffix = tostring(split(Caller, "@")[1])
| extend Source_Network_IPLocation = ""
| project
Alert_Category_en = "Azure Subscription",
Alert_SubCategory_en = "Anomaly User Access Resource",
Alert_Name_en = "Suspicious Azure VM Run Command Execution Detected",
Alert_Description_en=
strcat(
"At Taiwan time: ",
format_datetime(datetime_utc_to_local(StartTime, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
", detected user ",
iff(isnotempty(Caller), Caller, "<NoCaller>"),
" in subscription ",
iff(isnotempty(Subscription), Subscription, "<NoSubscription>"),
" executed against virtual machine ",
iff(isnotempty(VirtualMachineName), VirtualMachineName, "<NoVM>"),
" successfully performed Run Command operation: ",
OperationNameValue,
". Source IP: ",
iff(isnotempty(CallerIpAddress), CallerIpAddress, "<NoIP>"),
". The user was also flagged by UEBA detection for uncommon behavior: ",
iff(isnotempty(UEBAActionType), UEBAActionType, "<NoUEBAType>"),
", source location: ",
iff(isnotempty(UEBASourceIPLocation), UEBASourceIPLocation, "<NoLocation>"),
", indicating this administrative operation has potential account abuse risk."
),
Alert_TriageStep_en=
strcat(
"1. Confirm whether user ",
iff(isnotempty(Caller), Caller, "<NoCaller>"),
" is a legitimate operator/maintainer of the VM, and check whether there is a corresponding change or maintenance ticket.",
"2. Review whether Run Command is an expected command and confirm whether it involves download, account creation, service modification, or persistence behavior.",
"3. Compare source IP ",
iff(isnotempty(CallerIpAddress), CallerIpAddress, "<NoIP>"),
" with the location flagged by UEBA ",
iff(isnotempty(UEBASourceIPLocation), UEBASourceIPLocation, "<NoLocation>"),
" to determine whether it is abnormal (VPN, uncommon location, jump server)."
),
Alert_Containment_en=
strcat(
"1. If confirmed as an unauthorized operation, immediately revoke user ",
iff(isnotempty(Caller), Caller, "<NoCaller>"),
" 's existing sign-in sessions and access tokens, and force re-authentication or suspend the account.",
"2. Temporarily remove the account's administrative permissions on the target virtual machine (such as Virtual Machine Contributor / Owner) to prevent Run Command from being executed again.",
"3. For source IP ",
iff(isnotempty(CallerIpAddress), CallerIpAddress, "<NoIP>"),
" block it or increase Conditional Access restrictions to prevent continued abuse.",
"4. Depending on the risk level, isolate the affected VM and perform cybersecurity forensics to prevent lateral movement or malicious persistence."
),
Alert_Remediation_en=
strcat(
"1. Apply the least privilege principle to all roles that can execute Run Command, and manage high-privilege accounts through PIM/JIT.",
"2. Strengthen Conditional Access policies by requiring management operations to pass MFA, device compliance, and named location checks, and block uncommon location sign-ins.",
"3. Establish real-time alerts and automated response for Run Command-related activity, such as revoking sessions, disabling accounts, and notifying SOC.",
"4. Ensure Defender for Cloud and EDR are enabled on virtual machines, and regularly audit scheduled tasks, services, and startup items on VMs to avoid malicious command remnants.",
"5. Reduce the risk of hosts being exploited again through known vulnerabilities by applying regular security patches and vulnerability updates."
),
Alert_Time_TW = datetime_utc_to_local(StartTime, "Asia/Taipei"),
Alert_Time_UTC0 = StartTime,
Event_TimeRange_Start_TW = datetime_utc_to_local(StartTime, 'Asia/Taipei'),
Event_TimeRange_End_TW = datetime_utc_to_local(EndTime, 'Asia/Taipei'),
Event_TimeRange_Start_UTC0 = StartTime,
Event_TimeRange_End_UTC0 = EndTime,
Event_Action = OperationNameValue,
//Event_Code = score,
Source_Identity_FullName = Caller,
//Source_Identity_ID = ActorID,
Source_Identity_Type = iff(Caller contains '@', "User", "Service"),
Source_Network_IPAddress = CallerIpAddress,
Source_Network_IPLocation = Source_Network_IPLocation,
Target_Device_Name = VirtualMachineName,
Target_Resource_ID = Subscription,
Target_Resource_Type = "Azure Subscription"
tactics:
- LateralMovement
- CredentialAccess
queryFrequency: 1d
id: 6fa564ac-dfb7-4753-a49b-5fc919866c28
triggerThreshold: 0
triggerOperator: gt
name: '[AzureSubscription] Suspicious Azure VM Run Command Execution Detected'
queryPeriod: 2d
severity: High
entityMappings:
- fieldMappings:
- columnName: Source_Identity_FullName
identifier: FullName
entityType: Account
- fieldMappings:
- columnName: Target_Device_Name
identifier: HostName
entityType: Host
- fieldMappings:
- columnName: Source_Network_IPAddress
identifier: Address
entityType: IP
description: |
Detects Azure VM Run Command execution correlated with unusual sign-in behavior from UEBA. This can indicate administrative abuse or post-compromise activity.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6fa564ac-dfb7-4753-a49b-5fc919866c28')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6fa564ac-dfb7-4753-a49b-5fc919866c28')]",
"properties": {
"alertRuleTemplateName": "6fa564ac-dfb7-4753-a49b-5fc919866c28",
"customDetails": null,
"description": "Detects Azure VM Run Command execution correlated with unusual sign-in behavior from UEBA. This can indicate administrative abuse or post-compromise activity.\n",
"displayName": "[AzureSubscription] Suspicious Azure VM Run Command Execution Detected",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Source_Identity_FullName",
"identifier": "FullName"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Target_Device_Name",
"identifier": "HostName"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "Source_Network_IPAddress",
"identifier": "Address"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BAzureSubscription%5D%20Suspicious%20Azure%20VM%20Run%20Command%20Execution%20Detected.yaml",
"query": "AzureActivity\n// Isolate run command actions\n| where OperationNameValue =~ \"MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION\"\n// Confirm that the operation impacted a virtual machine\n| where Authorization has \"virtualMachines\"\n// Each runcommand operation consists of three events when successful, Started, Accepted (or Rejected), Successful (or Failed).\n| summarize\n StartTime=min(TimeGenerated),\n EndTime=max(TimeGenerated),\n max(CallerIpAddress),\n make_list(ActivityStatusValue)\n by CorrelationId, Authorization, Caller, OperationNameValue\n// Limit to Run Command executions that Succeeded\n| where list_ActivityStatusValue has_any (\"Success\", \"Succeeded\")\n// Extract data from the Authorization field\n| extend Authorization_d = parse_json(Authorization)\n| extend Scope = Authorization_d.scope\n| extend Scope_s = split(Scope, \"/\")\n| extend Subscription = tostring(Scope_s[2])\n| extend VirtualMachineName = tostring(Scope_s[-1])\n| project\n StartTime,\n EndTime,\n Subscription,\n VirtualMachineName,\n CorrelationId,\n Caller,\n CallerIpAddress=max_CallerIpAddress,\n OperationNameValue\n// Create a join key using the Caller (UPN)\n| extend joinkey = tolower(Caller)\n// Join the Run Command actions to UEBA data\n| join kind = inner (\n BehaviorAnalytics\n // We are specifically interested in unusual logins\n | where EventSource == \"Azure AD\" and ActivityInsights.ActionUncommonlyPerformedByUser == \"True\"\n | project\n UEBAEventTime=TimeGenerated,\n UEBAActionType=ActionType,\n UserPrincipalName,\n UEBASourceIPLocation=SourceIPLocation,\n UEBAActivityInsights=ActivityInsights,\n UEBAUsersInsights=UsersInsights\n | where isnotempty(UserPrincipalName) and isnotempty(UEBASourceIPLocation)\n | extend joinkey = tolower(UserPrincipalName)\n )\n on joinkey\n// Create a window around the UEBA event times, check to see if the Run Command action was performed within them\n| extend UEBAWindowStart = UEBAEventTime - 1h, UEBAWindowEnd = UEBAEventTime + 6h\n| where StartTime between (UEBAWindowStart .. UEBAWindowEnd)\n| project\n StartTime,\n EndTime,\n Subscription,\n VirtualMachineName,\n Caller,\n CallerIpAddress,\n UEBAEventTime,\n UEBAActionType,\n UEBASourceIPLocation,\n UEBAActivityInsights,\n UEBAUsersInsights,\n OperationNameValue\n| extend\n AccountName = tostring(split(Caller, \"@\")[0]),\n AccountUPNSuffix = tostring(split(Caller, \"@\")[1])\n| extend Source_Network_IPLocation = \"\"\n| project\n Alert_Category_en = \"Azure Subscription\",\n Alert_SubCategory_en = \"Anomaly User Access Resource\",\n Alert_Name_en = \"Suspicious Azure VM Run Command Execution Detected\",\n Alert_Description_en=\n strcat(\n \"At Taiwan time: \",\n format_datetime(datetime_utc_to_local(StartTime, \"Asia/Taipei\"), \"yyyy-MM-dd HH:mm:ss\"),\n \", detected user \",\n iff(isnotempty(Caller), Caller, \"<NoCaller>\"),\n \" in subscription \",\n iff(isnotempty(Subscription), Subscription, \"<NoSubscription>\"),\n \" executed against virtual machine \",\n iff(isnotempty(VirtualMachineName), VirtualMachineName, \"<NoVM>\"),\n \" successfully performed Run Command operation: \",\n OperationNameValue,\n \". Source IP: \",\n iff(isnotempty(CallerIpAddress), CallerIpAddress, \"<NoIP>\"),\n \". The user was also flagged by UEBA detection for uncommon behavior: \",\n iff(isnotempty(UEBAActionType), UEBAActionType, \"<NoUEBAType>\"),\n \", source location: \",\n iff(isnotempty(UEBASourceIPLocation), UEBASourceIPLocation, \"<NoLocation>\"),\n \", indicating this administrative operation has potential account abuse risk.\"\n),\n Alert_TriageStep_en=\n strcat(\n \"1. Confirm whether user \",\n iff(isnotempty(Caller), Caller, \"<NoCaller>\"),\n \" is a legitimate operator/maintainer of the VM, and check whether there is a corresponding change or maintenance ticket.\",\n \"2. Review whether Run Command is an expected command and confirm whether it involves download, account creation, service modification, or persistence behavior.\",\n \"3. Compare source IP \",\n iff(isnotempty(CallerIpAddress), CallerIpAddress, \"<NoIP>\"),\n \" with the location flagged by UEBA \",\n iff(isnotempty(UEBASourceIPLocation), UEBASourceIPLocation, \"<NoLocation>\"),\n \" to determine whether it is abnormal (VPN, uncommon location, jump server).\"\n),\n Alert_Containment_en=\n strcat(\n \"1. If confirmed as an unauthorized operation, immediately revoke user \",\n iff(isnotempty(Caller), Caller, \"<NoCaller>\"),\n \" 's existing sign-in sessions and access tokens, and force re-authentication or suspend the account.\",\n \"2. Temporarily remove the account's administrative permissions on the target virtual machine (such as Virtual Machine Contributor / Owner) to prevent Run Command from being executed again.\",\n \"3. For source IP \",\n iff(isnotempty(CallerIpAddress), CallerIpAddress, \"<NoIP>\"),\n \" block it or increase Conditional Access restrictions to prevent continued abuse.\",\n \"4. Depending on the risk level, isolate the affected VM and perform cybersecurity forensics to prevent lateral movement or malicious persistence.\"\n),\n Alert_Remediation_en=\n strcat(\n \"1. Apply the least privilege principle to all roles that can execute Run Command, and manage high-privilege accounts through PIM/JIT.\",\n \"2. Strengthen Conditional Access policies by requiring management operations to pass MFA, device compliance, and named location checks, and block uncommon location sign-ins.\",\n \"3. Establish real-time alerts and automated response for Run Command-related activity, such as revoking sessions, disabling accounts, and notifying SOC.\",\n \"4. Ensure Defender for Cloud and EDR are enabled on virtual machines, and regularly audit scheduled tasks, services, and startup items on VMs to avoid malicious command remnants.\",\n \"5. Reduce the risk of hosts being exploited again through known vulnerabilities by applying regular security patches and vulnerability updates.\"\n),\n Alert_Time_TW = datetime_utc_to_local(StartTime, \"Asia/Taipei\"),\n Alert_Time_UTC0 = StartTime,\n Event_TimeRange_Start_TW = datetime_utc_to_local(StartTime, 'Asia/Taipei'),\n Event_TimeRange_End_TW = datetime_utc_to_local(EndTime, 'Asia/Taipei'),\n Event_TimeRange_Start_UTC0 = StartTime,\n Event_TimeRange_End_UTC0 = EndTime,\n Event_Action = OperationNameValue,\n //Event_Code = score,\n Source_Identity_FullName = Caller,\n //Source_Identity_ID = ActorID,\n Source_Identity_Type = iff(Caller contains '@', \"User\", \"Service\"),\n Source_Network_IPAddress = CallerIpAddress,\n Source_Network_IPLocation = Source_Network_IPLocation,\n Target_Device_Name = VirtualMachineName,\n Target_Resource_ID = Subscription,\n Target_Resource_Type = \"Azure Subscription\"\n",
"queryFrequency": "P1D",
"queryPeriod": "P2D",
"severity": "High",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"CredentialAccess",
"LateralMovement"
],
"techniques": [
"T1212",
"T1570"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}