Azure New CloudShell Created

Title: Azure New CloudShell Created
Status: test
Description:Identifies when a new cloudshell is created inside of Azure portal.
References:
  -https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Author: Austin Songer
Date: 2021-09-21
modified:2022-08-23
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• product: azure
• service: activitylogs

Detection:
  selection:
    operationName: 'MICROSOFT.PORTAL/CONSOLES/WRITE'
  condition:selection
Falsepositives:
  -A new cloudshell may be created by a system administrator.
Level: medium