Discovery Using AzureHound

Title: Discovery Using AzureHound
Status: test
Description:Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.
References:
  -https://github.com/BloodHoundAD/AzureHound
Author: Janantha Marasinghe
Date: 2022-11-27
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1087.004'
• -'attack.t1526'

Logsource:

• product: azure
• service: signinlogs

Detection:
  selection:
    userAgent|contains: 'azurehound'
    ResultType: '0'
  condition:selection
Falsepositives:
  -Unknown
Level: high