Log sources › azure:activity

azure:activity

Inverted view: what can be detected if this is the log you have. IaaS, Identity Provider, Windows

channels

analytics

techniques

KEV CVEs reachable

"Reachable" means: a KEV CVE has a public mapping to a technique, and MITRE's analytic for that technique names this log source. It is a statement about published knowledge, not about whether any particular rule fires.

Channels

Channel	Data components	Analytics	Techniques
`Azure CLI Operation: Microsoft.Graph/users/read`	DC0013 User Account Metadata	AN1088	1
`CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows`	DC0055 File Access	AN0708	1
`MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE`	DC0081 Instance Deletion	AN0234	1
`MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE`	DC0076 Instance Creation	AN1242	1
`Microsoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloads`	DC0029 Script Execution	AN1502	1
`Microsoft.Compute/virtualMachines/write: imageReference publisher NOT IN allowlist OR plan is new/unknown`	DC0076 Instance Creation	AN0692	1
`Update conditionalAccessPolicy`	DC0066 Active Directory Object Modification	AN0088	1
`networkInsightsLogs`	DC0085 Network Traffic Content	AN0908	1
`operationName: Write, Access Review, RoleAssignment`	DC0069 Cloud Service Modification	AN0215	1

Techniques detectable from this source

Technique	Tactics	Sigma rules	KEV CVEs
T1049 System Network Connections Discovery	discovery	9	1
T1059.009 Cloud API	execution	3	0
T1087.004 Cloud Account	discovery	3	0
T1204.003 Malicious Image	execution	0	0
T1556.009 Conditional Access Policies	defense impairment, persistence, credential access	0	0
T1578.002 Create Cloud Instance	defense impairment	0	0
T1578.003 Delete Cloud Instance	defense impairment	1	0
T1651 Cloud Administration Command	execution	0	0
T1654 Log Enumeration	discovery	0	0

KEV CVEs reachable from this source

CVE	Vendor / product	Via technique	State
CVE-2022-41328	Fortinet FortiOS	T1049	Mapped