This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

Read More

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

Read More

Identifies when a application credential is modified.

Read More

Identifies when a application is deleted in Azure.

Read More

Identifies when a application gateway is modified or deleted.

Read More

Identifies when a application security group is modified or deleted.

Read More

Detects when a Container Registry is created or deleted.

Read More

Identifies when a device in azure is no longer managed or compliant

Read More

Identifies when a device or device configuration in azure is modified or deleted.

Read More

Identifies when DNS zone is modified or deleted.

Read More

Identifies when a firewall is created, modified, or deleted.

Read More

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

Read More

Identifies when a Firewall Rule Configuration is Modified or Deleted.

Read More

Identifies when a key vault is modified or deleted.

Read More

Identifies when a Keyvault Key is modified or deleted in Azure.

Read More

Identifies when secrets are modified or deleted in Azure.

Read More

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More

Detects when a Azure Kubernetes Cluster is created or deleted.

Read More

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Read More

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Read More

Identifies when a Azure Kubernetes network policy is modified or deleted.

Read More

Identifies the deletion of Azure Kubernetes Pods.

Read More

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Read More

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Read More

Identifies when ClusterRoles/Roles are being modified or deleted.

Read More

Identifies when a service account is modified or deleted.

Read More

Identifies when a Firewall Policy is Modified or Deleted.

Read More

Identifies when a network security configuration is modified or deleted.

Read More

Identifies when a new cloudshell is created inside of Azure portal.

Read More

Identifies when a owner is was removed from a application or service principal in Azure.

Read More

Identifies when a Point-to-site VPN is Modified or Deleted.

Read More

Identifies when a service principal is created in Azure.

Read More

Identifies when a service principal was removed in Azure.

Read More

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Read More

Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

Read More

Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.

Read More

Identifies when a Virtual Network is modified or deleted in Azure.

Read More

Identifies when a VPN connection is modified or deleted.

Read More

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

Read More

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Read More

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Read More

User Added to an Administrator's Azure AD Role

Read More