Number Of Resource Creation Or Deployment Activities

Title: Number Of Resource Creation Or Deployment Activities
Status: test
Description:Number of VM creations or deployment activities occur in Azure via the azureactivity log.
References:
  -https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
Author: sawwinnnaung
Date: 2020-05-07
modified:2023-10-11
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1098'

Logsource:

• product: azure
• service: activitylogs

Detection:
  keywords:
    - 'Microsoft.Compute/virtualMachines/write'
    - 'Microsoft.Resources/deployments/write'
  condition:keywords
Falsepositives:
  -Valid change
Level: medium