{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Azure Threat Research Matrix Workbook\n---\n\n" }, "name": "text - 2" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c8d0a421-e106-400d-a9a6-753333b2927e", "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "value": [], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "includeAll": false, "showDefault": false }, "timeContext": { "durationMs": 86400000 } }, { "id": "15ae10ce-a737-4d1e-bb84-0490207e8c7d", "version": "KqlParameterItem/1.0", "name": "Workspace", "type": 5, "description": "Select Workspace where Azure Activity Logs are available", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id", "crossComponentResources": [ "{Subscription}" ], "value": [ "/subscriptions/dd537ae2-89c2-47ac-b66a-17d8bc7daca9/resourceGroups/SentinelRG/providers/Microsoft.OperationalInsights/workspaces/M365sentinel" ], "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, { "id": "2deb21f7-8d02-4112-aee2-df86abceec6f", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "value": { "durationMs": 2592000000 }, "typeSettings": { "selectableValues": [ { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 9" }, { "type": 1, "content": { "json": "#### Azure Threat Research Matrix (ATRM),is a knowledge base that provides details around the tactics & techniques, a potential adversary may use to compromise an Azure Resource or Azure Active Directory. Objective of this workbook is to educate security professionals on various threat vectors to Azure resources when not following Azure Security Best Practices and their detection methods using ATRM framework.It is not intended to be complete list. Reference: https://techcommunity.microsoft.com/blog/microsoft-security-blog/introducing-the-azure-threat-research-matrix/3584976\r\n#### This Workbook utilizes Azure Activity Logs and Entra ID Audit Logs as a data source and it can be used to monitor sensitive operations from security aspects. Suspecious activities in Azure Resources can be detected by reviewing who performed it and from which IP.This workbook leverages detection methods provided in Azure Threat Research Matrix . Link: https://microsoft.github.io/Azure-Threat-Research-Matrix/", "style": "info" }, "name": "text - 28", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "  Please take time to answer a quick survey,\r\n[ click here. ](https://forms.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR6WFGSmpLgBFs8JcO3-8uANUOUpaWlNYWEIxTTI0VldWVk40V0VBOFVIWS4u)" }, "name": "text - 27" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "tabStyle": "bigger", "links": [ { "id": "c739b2d9-5aae-49d6-a60d-71e2579027a3", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Overall Activities", "subTarget": "overall", "preText": "Overall Activities", "style": "link" }, { "id": "8d0877b6-40e9-49cd-aca6-19de8a51ba91", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Compute", "subTarget": "compute", "style": "link" }, { "id": "e5eff5f5-d41e-4a4d-9756-9701368ab954", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Network", "subTarget": "network", "style": "link" }, { "id": "e6003cc2-c70f-4d76-9e44-4f51f549234b", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Policy", "subTarget": "policy", "style": "link" }, { "id": "d3d8e694-6d6a-42d8-a771-14c36c1b4721", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Security", "subTarget": "security", "style": "link" }, { "id": "9e5ce69d-94ef-4dc8-9d70-9e01d410481a", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Data", "subTarget": "data", "style": "link" }, { "id": "e1827ecf-625c-4d02-a78d-17f47f0853b2", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Subscription", "subTarget": "account", "style": "link" }, { "id": "0b23a7ca-8b0a-4c01-b521-b67e7471fabd", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Application", "subTarget": "app", "style": "link" }, { "id": "c4024de2-141c-4b01-b223-2cd1ae86c09a", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "External Access", "subTarget": "external", "style": "link" }, { "id": "3329cbd4-200b-45e7-ba22-1556d238d216", "cellValue": "wbtab", "linkTarget": "parameter", "linkLabel": "Identity", "subTarget": "identity", "style": "link" } ] }, "name": "links - 10" }, { "type": 1, "content": { "json": "#### Review who is doing any admin activities (like Update/delete) in your environment. Specifically look for any Non IT team user or Guest user accounts for any suspicious activities like mass deletion of resources. You can also select the account for further drill down of activities performed and check their earliest and latest activities to see how long they are doing such activities in your environment. If their earliest time is very recent, it may indicate a new account performing such activities in your environment and you may want to analyze those accounts if they are authorized ones. ", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "overall" }, "name": "text - 42", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n//| where Category == \"Administrative\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| where isnotempty(Caller)\r\n| summarize deletions = countif(OperationNameValue hassuffix \"Delete\"), updates = countif(OperationNameValue hassuffix \"write\"), Activities = count() by Caller", "size": 0, "showAnalytics": true, "title": "Overall Activities", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Caller", "exportParameterName": "callerexport", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "overall" }, "name": "Overall Activities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller == \"{callerexport}\"\r\n//| where Category == \"Administrative\"\r\n//| where OperationNameValue hassuffix \"Delete\" or OperationNameValue hassuffix \"write\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 0, "showAnalytics": true, "title": "Selected Caller Activities (Please select caller from above overall activities table)", "noDataMessage": "Please select caller from above overall activities table", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "overall" }, "name": "Caller Activities" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where Caller == \"{callerexport}\"\r\n//| where Category == \"Administrative\"\r\n//| where OperationNameValue hassuffix \"Delete\" or OperationNameValue hassuffix \"write\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| summarize total=count(), min(TimeGenerated), max(TimeGenerated) by OperationNameValue, Caller\r\n| sort by total desc ", "size": 0, "showAnalytics": true, "title": "Operations with earliest and latest occurance for the selected caller", "noDataMessage": "Please select caller from above overall activities table", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "overall" }, "name": "Caller Activities - Copy" }, { "type": 1, "content": { "json": "#### Security Products Modification : Adversaries can disable or modify Sentinel Analytic Rules, Data Connectors, Workbooks, Alerts or diagnostic settings to prevent detection. Review any changes to Analytic rules, Alerts and diagnostic settings for any suspecious activities. Note Changes to Playbooks are covered under Application section.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "securitytxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.SecurityInsights/alertRules/write\", \"Microsoft.SecurityInsights/alertRules/delete\"]);\r\n// Microsoft Sentinel Analytics - Rule Create / Update / Delete\r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Sentinel Analytic Rules Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Sentinel Analytic Rules Changes" }, { "type": 1, "content": { "json": "#### Network Security Group Modification: Adversaries can modify the rules in a Network Security Group to establish unauthorized access over addidtional IP address or ports.Review the changes and who performed it from which IP.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT506/AZT506/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "nsgrulechangetxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Network/networkSecurityGroups/write\", \"Microsoft.Network/networkSecurityGroups/delete\"]);\r\n// Azure NSG Create / Update / Delete\r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "NSG Rule Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "NSG Rule Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.SecurityInsights/dataConnectors/write\", \"Microsoft.SecurityInsights/dataConnectors/delete\"]);\r\n// Microsoft Sentinel Data Connectors Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Sentinel Data Connector Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Sentinel Data Connector Changes" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Insights/ActivityLogAlerts/Delete\", \"Microsoft.Insights/ActivityLogAlerts/Write\", \"Microsoft.Insights/ActionGroups/Write\", \"Microsoft.Insights/ActionGroups/Delete\"]);\r\n// Log Alerts Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Log Alerts Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Azure Log Alerts Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.insights/diagnosticSettings/delete\", \"microsoft.insights/diagnosticSettings/write\"]);\r\n// Diagnostic Settings Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Resource Diagnostic Settings Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Resource Diagnostic Settings Changes " }, { "type": 1, "content": { "json": "#### Azure Policy Backdoor: By configuring a policy with the 'DeployIfNotExists' definition or by disabling a policy requiring a security guardrail, an adverary may establish persistence by creating a backdoor.Review any changes to your Azure policies. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT508/AZT508/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "policychangetxt" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Authorization/policyAssignments/delete\", \"Microsoft.Authorization/policyAssignments/write\", \"Microsoft.Authorization/policyDefinitions/delete\"]);\r\n// Azure Policy Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Policy Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "Azure Policy Changes " }, { "type": 1, "content": { "json": "#### Resource Lock Manipulation: Resource Lock protects against any accidental deletion or update. Review who removed or added the resource locks. ", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "lockchangetxt ", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Authorization/locks/write\", \"Microsoft.Authorization/locks/delete\"]);\r\n// Azure Policy Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Resource Locks Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "Azure Resource Locks Changes " }, { "type": 1, "content": { "json": "#### Azure Policy Backdoor: Review the deployment attempts denied by policy for any suspecious activities.Adversaries can use policies to disable safeguards. ", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "policydeniedtxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue == \"Microsoft.Authorization/policies/deny/action\"\r\n| where ActivityStatusValue == \"Failed\"\r\n| extend Policydetail = tolower(tostring(todynamic(Properties).['policies']))\r\n| extend PolicyAssignmentName = tolower(tostring(todynamic(Policydetail)[0].['policyassignmentdisplayname']))\r\n| extend PolicyDefinitionName = tolower(tostring(todynamic(Policydetail)[0].['policydefinitiondisplayname']))\r\n| extend AssignementID = tolower(tostring(todynamic(Policydetail)[0].['policyassignmentid']))\r\n| project TimeGenerated, Caller, ActivityStatusValue, ResourceGroup, ResourceProviderValue, Resource, _ResourceId, _SubscriptionId, PolicyAssignmentName, PolicyDefinitionName, AssignementID", "size": 1, "showAnalytics": true, "title": "Resource Deployment Denied by Azure Policy", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "Resource Deployment Denied by Azure Policy " }, { "type": 1, "content": { "json": "#### Azure Policy Backdoor: Review the deployments performed by policy for any suspecious activities.Adversaries can use policies to deploy any unauthorized resources. ", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "policydeniedtxt - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue == \"Microsoft.Authorization/policies/deployIfNotExists/action\"\r\n| extend Pupdated = tolower(tostring(todynamic(Properties).['updatedResources']))\r\n| where Pupdated != \"[]\" and Pupdated != \"\"\r\n| extend Policydetail = tolower(tostring(todynamic(Properties).['policies']))\r\n| extend PolicyName = tolower(tostring(todynamic(Policydetail)[0].['policyassignmentdisplayname']))\r\n| extend PolicyDefinitionName = tolower(tostring(todynamic(Policydetail)[0].['policydefinitiondisplayname']))\r\n| extend AssignementID = tolower(tostring(todynamic(Policydetail)[0].['policyassignmentid']))\r\n| project Resource, ResourceGroup, _ResourceId, SubscriptionId, Caller, PolicyName, PolicyDefinitionName, AssignementID, UpdatedObject=Pupdated \r\n", "size": 1, "showAnalytics": true, "title": "Resource Deployment Performed by Azure Policy", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "policy" }, "name": "Resource Deployment performed by Azure Policy " }, { "type": 1, "content": { "json": "#### Data Exfiltration: Adversaries mostly target the data repositaries such as databases, storage accounts, Key Vaults for potential data exfiltration attacks. Review the activity logs for any suspecious activities by unknowm person from strange IP.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "sqlchangetxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Sql/servers/administrators/write\", \"Microsoft.Sql/servers/administrators/delete\",\"Microsoft.Sql/servers/elasticPools/delete\",\"Microsoft.Sql/servers/databases/delete\"]);\r\n// Azure SQL Update / Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure SQL Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "Azure SQL Changes " }, { "type": 1, "content": { "json": "#### SAS URI Generation: Adversaries can create SAS URI or replication policies for potential data exfiltration attacks. Review the activity logs for any suspecious activities. Link: https://microsoft.github.io/Azure-Threat-Research-Matrix/Impact/AZT703/AZT703-1/ , https://microsoft.github.io/Azure-Threat-Research-Matrix/Impact/AZT701/AZT701-2/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "sqlchangetxt - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Storage/storageAccounts/delete\", \"Microsoft.Storage/storageAccounts/create\", \"Microsoft.Storage/storageAccounts/objectReplicationPolicies/write\", \"Microsoft.Storage/storageAccounts/listkeys/action\", \"Microsoft.Storage/storageAccounts/listAccountSas/action\"]);\r\n// Azure Storage Delete\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure Storage Account Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "Azure Storage Changes " }, { "type": 1, "content": { "json": "#### Azure Key Vault Dumping: Adversaries can target Key Vaults for potential data exfiltration attacks. Review the activity logs for any suspecious activities like someone updating credentials. Note you need Azure Diagnostic Logs to monitor who read credentails and is not covered under this workbook.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "sqlchangetxt - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.KeyVault/vaults/write\", \"Microsoft.KeyVault/vaults/delete\",\"Microsoft.KeyVault/vaults/secrets/write\"]);\r\n// Keyvault \r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure KeyVault Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "data" }, "name": "Azure KeyVault Changes " }, { "type": 1, "content": { "json": "#### Azure DNS Zone Tampering : Adversaries can modify the DNS zones or delete DNS zones.Review the changes and who performed it from which IP.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "dnschangetxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//let opValues = dynamic([\"Microsoft.Network/dnszones/write\", \"Microsoft.Network/dnszones/delete\"]);\r\n// Azure Storage Delete\r\nAzureActivity\r\n| where OperationNameValue contains \"dnszones\"\r\n| where ActivityStatus == \"Succeeded\"\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Azure DNS Changes ", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "Azure DNS Changes " }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.insights/workbooks/write\", \"microsoft.insights/workbooks/delete\"]);\r\n// Microsoft Sentinel Workbook Create / Update / Delete\r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Sentinel Workbook Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ], "gridSettings": { "filter": true } }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "security" }, "name": "Sentinel Workbook Changes" }, { "type": 1, "content": { "json": "#### Virtual Machine Scripting: By utilizing the 'CustomScriptExtension' extension on a Virtual Machine, Threat Actor can pass PowerShell commands to the VM as SYSTEM account.Review any \"Create or Update Virtual Machine Extension\" activities for any suspicious ones. Link: https://microsoft.github.io/Azure-Threat-Research-Matrix/Execution/AZT301/AZT301-2/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "extensionchange", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "// VM extensions Create / Update \r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n| where OperationNameValue =~ \"MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Extension Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Extension Changes" }, { "type": 1, "content": { "json": "#### Virtual Machine Scripting: By utilizing Compute Gallery Applications, Threat Actor can pass MS-DOS or PowerShell commands to the VM as SYSTEM account.Review any \"Create or Update Gallery Application\" activities for any suspicious ones. Link: https://microsoft.github.io/Azure-Threat-Research-Matrix/Execution/AZT301/AZT301-4/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "galleryappchange ", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Compute/galleries/write\", \"Microsoft.Compute/galleries/applications/write\", \"Microsoft.Compute/galleries/applications/versions/write\"]);\r\n// Gallery Application\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n//| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Compute Gallery Application Changes ", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "Compute Gallery Application Changes " }, { "type": 1, "content": { "json": "#### Virtual Machine Scripting: By utilizing the 'RunCommand' feature on a Virtual Machine, Threat Actor can pass PowerShell commands to the VM as SYSTEM account in Windows or pass Shell commands to the VM as root in Linux systems.Review run command activities for any suspicious ones. Link: https://microsoft.github.io/Azure-Threat-Research-Matrix/Execution/AZT301/AZT301-1/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "vmruncmdtxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.compute/virtualmachines/runcommand/action\", \"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action\"]);\r\n// VM and VMSS Run Command\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Run Commands", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Run Commands" }, { "type": 1, "content": { "json": "#### VM Password Reset: By utilizing the 'password reset' feature on a Virtual Machine, Threat Actor can reset the password for local accounts in a VM and use it for persistance in your environment. Review for any suspecious password reset activities.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "vmruncmdtxt - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| extend OperationNameValue\r\n| where OperationNameValue =~ \"MICROSOFT.RESOURCES/DEPLOYMENTS/VALIDATE/ACTION\"\r\n| where _ResourceId contains \"VMAccessWindowsPasswordReset\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, _ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Password Reset", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Password Reset" }, { "type": 1, "content": { "json": "#### VM Disk SAS URI: VM Disks can be exported by utilizing SAS URI, By generating an SAS URI for a resource, an adversary may extract the contents of that resource without authentication at any time. Review for any SAS URI generation activities. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Impact/AZT701/AZT701/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "vmruncmdtxt - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| extend OperationNameValue\r\n| where OperationNameValue =~ \"Microsoft.Compute/disks/BeginGetAccess/action\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, _ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Disk SAS URI", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Disk SAS URI" }, { "type": 1, "content": { "json": "#### Serial Console Attack: By utilizing the serial console feature on an Azure Virtual Machine, an adversary can pass arbitrary commands. Review for any suspecious connection attempts by adversary. Link : https://microsoft.github.io/Azure-Threat-Research-Matrix/Execution/AZT301/AZT301-7/ , https://msrc.microsoft.com/blog/2023/08/azure-serial-console-attack-and-defense-part-1/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "serialconsoletxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| extend OperationNameValue\r\n| where OperationNameValue =~ \"MICROSOFT.SERIALCONSOLE/SERIALPORTS/CONNECT/ACTION\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, _ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Serial Console Access", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Serial Console Access" }, { "type": 1, "content": { "json": "#### VM Disk Snapshot: Review who is taking the snapshot of your disks.Threat actor can use it for data exfiltration.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VMdisksnapshottx", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| extend OperationNameValue\r\n| where OperationNameValue =~ \"MICROSOFT.COMPUTE/SNAPSHOTS/WRITE\"\r\n//| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatusValue, Caller, CallerIpAddress, _ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "VM Disk Snapshot activity", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Disk Snapshot activity" }, { "type": 1, "content": { "json": "#### AKS command invoke: By utilizing 'command invoke' on an Azure Kubernetes Service (AKS) cluster, Threat Actor can pass commands to the cluster's VM as SYSTEM account. Review for any unauthorized activities. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Execution/AZT301/AZT301-5/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "akscmdinvoketxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.ContainerService/managedClusters/runcommand/action\", \"Microsoft.ContainerService/managedclusters/commandResults/read\"]);\r\n// AKS\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n//| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "AKS Cluster Command Invoke", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "AKS Cluster Command Invoke" }, { "type": 1, "content": { "json": "#### AppService WebJob: Adversaries may create a WebJob on a App Service which allows arbitrary background tasks to be run on a set schedule. Below table also lists any changes to the app services. Review for any suspecious ones. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-4/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "appchangetxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"microsoft.web/sites/delete\", \"microsoft.web/sites/config\", \"Microsoft.Web/sites/write\", \"Microsoft.Web/sites/start/action\",\"Microsoft.Web/sites/hostruntime/host/action\", \"Microsoft.Web/sites/hostruntime/vfs/run.csx/write\" ]);\r\n// App Services Changes\r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "App Services Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "App Services Changes" }, { "type": 1, "content": { "json": "#### Logic App HTTP Trigger: Adversaries may configure a Logic Application with a user account or managed identity and modify the HTTP trigger to run a command via HTTP request. Below table also lists any changes to the Logic app/ Playbooks. Review for any suspecious ones. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-1/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "appchangetxt - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Logic/workflows/write\", \"Microsoft.Logic/workflows/run/action\", \"Microsoft.Logic/operations/read\", \"Microsoft.Logic/locations/workflows/recommendOperationGroups/action\", \"Microsoft.Logic/workflows/triggers/listCallbackUrl/action\",\"Microsoft.Web/connections/write\" ]);\r\n// Logic App \r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Logic Application HTTP Trigger Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "Logic Application HTTP Trigger Changes" }, { "type": 1, "content": { "json": "#### Function App HTTP Trigger: Adversaries may configure a Function Application with a user account or managed identity and modify the HTTP trigger to run a command via HTTP request. Below table also lists any changes to the Function app. Review for any suspecious ones. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-2/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "appchangetxt - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.web/sites/functions/action\",\"Microsoft.web/sites/functions/write\" ]);\r\n// Function App \r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Function App HTTP Trigger Changes", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "Function App HTTP Trigger Changes - Copy" }, { "type": 1, "content": { "json": "#### Runbook Webhook: Adversaries may create a webhook to a Runbook which allows unauthenticated access into an Azure subscription or tenant. Below table also lists any changes to the automation accounts. Review for any suspecious ones. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "appchangetxt - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let opValues = dynamic([\"Microsoft.Automation/automationAccounts/runbooks/*\",\"Microsoft.Automation/automationAccounts/webhooks/write\" ]);\r\n// Runbook App \r\nAzureActivity\r\n| where OperationNameValue in~ (opValues)\r\n| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Automation Account Runbook Webhook Changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "app" }, "name": "Automation Account Runbook Webhook Changes " }, { "type": 1, "content": { "json": "#### Azure Resource Role Change: Adversaries can perform privilege escalation attacks. Review who performed the role change and from which IP and when to detect any suspecious activities. ", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "rolechangetxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//let opValues = dynamic([\"microsoft.authorizations/elevateaccess/action\", \"microsoft.authorization/roleassignments/write\"]);\r\n// Role Changes\r\nAzureActivity\r\n//| where Category == \"Administrative\"\r\n//| where OperationNameValue in~ (opValues)\r\n//| where ActivitySubstatusValue in~ (\"Created\", \"OK\")\r\n//| sort by TimeGenerated desc\r\n//| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId\r\n| where OperationNameValue == \"MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE\" \r\n| extend Properties=parse_json(Properties) \r\n| extend requestbody = parse_json(tostring(parse_json(Properties).requestbody)) \r\n| extend PrincipalId= requestbody.Properties.PrincipalId \r\n| extend RoleDefinitionId= requestbody.Properties.RoleDefinitionId \r\n| extend Scope= requestbody.Properties.Scope \r\n| extend Entity = tostring(Properties.entity) \r\n| join kind=inner ( \r\nAzureActivity \r\n| where OperationNameValue == \"MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE\" \r\n| where ActivityStatusValue != \"Start\" | extend Entity = tostring(parse_json(Properties).entity) ) on CorrelationId,Entity,OperationNameValue \r\n| project TimeGenerated,OperationNameValue,PrincipalId,RoleDefinitionId,FinalStatus = ActivityStatusValue1, Caller, Properties, CallerIpAddress\r\n", "size": 1, "showAnalytics": true, "title": "Azure Resources Role Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "SubscriptionId", "parameterName": "SubscriptionId", "parameterType": 6, "defaultValue": "SubscriptionId" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "Azure Resources Role Changes" }, { "type": 1, "content": { "json": "#### Subscription Coverage : Below table lists the subscriptions available in your tenant and shows if their Activity Logs are connected to this Log Analytics workspace under \"IsMonitored\" column. Review if all the subscriptions are connected to this workspace.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "listroles", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let allsubscriptions=\r\narg(\"\").resourcecontainers\r\n| where type == \"microsoft.resources/subscriptions\"\r\n| distinct subscriptionId, name;\r\nallsubscriptions\r\n| join kind=leftouter (AzureActivity\r\n| extend AzureActivitySubscriptionId=SubscriptionId\r\n| distinct AzureActivitySubscriptionId)\r\non $left.subscriptionId==$right.AzureActivitySubscriptionId\r\n| extend IsMonitored= iff(isempty( AzureActivitySubscriptionId), \"No\", \"Yes\")\r\n| project subscriptionId, name, AzureActivitySubscriptionId, IsMonitored", "size": 1, "showAnalytics": true, "title": "Azure Activity Log Connected to this Workspace", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "SubscriptionId", "parameterName": "SubscriptionId", "parameterType": 6, "defaultValue": "SubscriptionId" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "Azure Activity Logs Coverage" }, { "type": 1, "content": { "json": "#### Subscription Hijacking: Adversaries can move their subscription to another tenant. Review any movements. Reference https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT507/AZT507-3/ , https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/hunt-for-compromised-azure-subscriptions-using-microsoft/ba-p/3607121", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "listroles - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where CategoryValue == \"Security\"\r\n| where Properties contains \"got moved from tenant\"", "size": 1, "showAnalytics": true, "title": "Subscription Hijack", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "SubscriptionId", "parameterName": "SubscriptionId", "parameterType": 6, "defaultValue": "SubscriptionId" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "Subscription Hijack" }, { "type": 1, "content": { "json": "#### Resource Group Movement: Below table shows the resources moved out of Resource Groups . Review any movements for any suspecious activites. Note you need to review any delete activities separately in the specified Resource Group to see which resource is moved out.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "listroles - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//let opValues = dynamic([\"MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/MOVERESOURCES/ACTION\"]);\r\nAzureActivity\r\n| where OperationNameValue =~ \"MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/MOVERESOURCES/ACTION\"\r\n| where ActivityStatusValue == \"Success\"\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Resource Group Movement ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "SubscriptionId", "parameterName": "SubscriptionId", "parameterType": 6, "defaultValue": "SubscriptionId" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "Resource Group Movement " }, { "type": 1, "content": { "json": "#### Cloud Shell Privilege Escalation: Below table shows the activities when cloudshell is used. Adversaries can perform privilege escalation by abusing the cloud shell files. Review who is using cloud shell. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT403/AZT403-1/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "listroles - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//let opValues = dynamic([\"MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/MOVERESOURCES/ACTION\"]);\r\nAzureActivity \r\n| where ResourceGroup startswith \"CLOUD-SHELL\" \r\n| where ResourceProviderValue == \"MICROSOFT.STORAGE\" \r\n| where ActivityStatusValue == \"Start\" \r\n| extend action_ = tostring(parse_json(Authorization).action)\r\n | summarize count() by TimeGenerated , ResourceGroup , Caller , CallerIpAddress , ActivityStatusValue\r\n | extend AccountCustomEntity = Caller \r\n| extend IPCustomEntity = CallerIpAddress", "size": 1, "showAnalytics": true, "title": "Cloud Shell Activity", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "SubscriptionId", "parameterName": "SubscriptionId", "parameterType": 6, "defaultValue": "SubscriptionId" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "Cloud Shell Activity" }, { "type": 1, "content": { "json": "#### Management Group Changes: Below table shows the activities when Management Group is created or deleted. Review Changes to ManagementGroup. Note: You need to enable Directory Activity Log Ingestion to Log Analytic Workspace. Reference:https://techcommunity.microsoft.com/discussions/azureobservability/how-to-monitor-new-management-group-creation-and-deletion-/4365710", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "Management Group Changes", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue in~ (\"MICROSOFT.MANAGEMENT/MANAGEMENTGROUPS/DELETE\",\"MICROSOFT.MANAGEMENT/MANAGEMENTGROUPS/WRITE\") \r\n| where ActivityStatusValue == \"Success\"\r\n| extend mg = split(tostring(Properties_d.entity),\"/\")\r\n| project TimeGenerated, activityStatusValue_ = tostring(Properties_d.activityStatusValue), Managementgroup = mg[4], message_ = tostring(parse_json(Properties).message),\r\ncaller_ = tostring(Properties_d.caller)", "size": 1, "showAnalytics": true, "title": "Changes in Management Group ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "SubscriptionId", "parameterName": "SubscriptionId", "parameterType": 6, "defaultValue": "SubscriptionId" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "Management Group Activity " }, { "type": 1, "content": { "json": "#### New Subscription: Below table shows the activities when a new Subscription is created. Review the Changes to Subscription. Note: You need to enable Directory Activity Log Ingestion to Log Analytic Workspace. Reference:https://techcommunity.microsoft.com/discussions/azureobservability/how-to-monitor-new-management-group-creation-and-deletion-/4365710", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "New Subscription ", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue == \"Microsoft.Management\" and ActivityStatusValue == \"Succeeded\" and isnotempty(SubscriptionId)", "size": 1, "showAnalytics": true, "title": "New Subsciption Added", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "SubscriptionId", "parameterName": "SubscriptionId", "parameterType": 6, "defaultValue": "SubscriptionId" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "account" }, "name": "New Subscription" }, { "type": 1, "content": { "json": "#### Azure Light House External Entity Access: Adversaries may utilize Azure Lighthouse to manage the target tenant from an external tenant. Review any Lighthouse Registration created. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT507/AZT507-1/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "lighthousetxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue =~ \"Microsoft.ManagedServices/registrationAssignments/Write\"\r\n| sort by TimeGenerated desc\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Lighthouse Registration Assignments by Service Provider", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "Lighthouse Registration Assignments by Service Provider" }, { "type": 1, "content": { "json": "#### Azure Light House External Entity Access: Adversaries may utilize Azure Lighthouse to manage the target tenant from an external tenant. Review available Lighthouse Registration in your environment. Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT507/AZT507-1/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "lighthousetxt - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "ManagedServicesResources\r\n| where type== \"microsoft.managedservices/registrationassignments\"", "size": 1, "showAnalytics": true, "title": "List of Lighthouse Registration Assignments by Service Provider", "showRefreshButton": true, "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "List of Lighthouse Registration Assignments by Service Provider - Copy" }, { "type": 1, "content": { "json": "#### External User Activities: Adversaries may utilize compromised External Accounts. Review activities performed by external users from other tenants. Note: You need to add your Domain Name as Home Tenant Domain in the query in edit mode.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "lighthousetxt - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "//Provide your Tenant Domain (example contoso.com)\r\nlet Hometenantdomain = dynamic([\"TENANT_DOMAIN_VALUE\"]);\r\nAzureActivity\r\n| where Caller !contains Hometenantdomain\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated desc\r\n| where parse_json(Claims).idtyp <> \"app\"\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, Caller, CallerIpAddress, \r\n ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Activities performed by Guest Users(Provide your Home Tenant Domain in the Query) ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "Activities performed by Guest Users " }, { "type": 1, "content": { "json": "#### External User Activities: Adversaries may utilize Azure Lighthouse to manage the target tenant from an external tenant. Review activities performed by external users (Like CSP/Lighthouse users) from other tenants. Note: You need to add your tenant ID as Home Tenant ID in the query in edit mode.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "lighthousetxt - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let HomeTenantId = \"Provide your Azure AD Tenant ID HERE\";\r\n//example HomeTenantId= \"8756erxyz-xxxxx-xxxx-xxxx\"\r\nAzureActivity\r\n| extend TenantId = todynamic(Claims).['http://schemas.microsoft.com/identity/claims/tenantid']\r\n| where TenantId != HomeTenantId\r\n| where isnotempty( TenantId )\r\n| where ActivitySubstatusValue in (\"Created\", \"OK\")\r\n| sort by TimeGenerated\r\n| project TimeGenerated, OperationName, OperationNameValue, ActivityStatus, TenantId , Caller, CallerIpAddress, ResourceId, ResourceGroup, SubscriptionId", "size": 1, "showAnalytics": true, "title": "Activities performed by external Lighthouse (CSP/MSP) Users (Provide your Home Tenant ID in the Query) ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "external" }, "name": "Activities performed by external CSP/MSP Users " }, { "type": 1, "content": { "json": "#### Network Port Changes:Adversaries can modify the network ports across firewall rules and NSG rules to establish unauthorized access.Review the changes and who performed it from which IP.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT506/AZT506/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "nwportchangetxt ", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AzureActivity\r\n| where OperationNameValue has_any (\"ipfilterrules\", \"securityRules\", \"publicIPAddresses\", \"firewallrules\") and OperationNameValue endswith \"write\"\r\n// Choosing Accepted here because it has the Rule Attributes included\r\n| where ActivityStatusValue == \"Accepted\" \r\n// If there is publicIP info, include it\r\n| extend publicIPAddress_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).ipAddress) \r\n| extend publicIPAddressVersion_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAddressVersion) \r\n| extend publicIPAllocationMethod_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAllocationMethod) \r\n// Include rule attributes for context\r\n| extend access = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).access) \r\n| extend description = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).description) \r\n| extend destinationPortRange = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).destinationPortRange) \r\n| extend direction = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).direction) \r\n| extend protocol = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).protocol) \r\n| extend sourcePortRange = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).sourcePortRange) \r\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), ResourceIds = makeset(ResourceId) by Caller, CallerIpAddress, Resource, ResourceGroup, \r\nActivityStatusValue, ActivitySubstatus, SubscriptionId, access, description, destinationPortRange, direction, protocol, sourcePortRange \r\n| extend timestamp = StartTime, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress\r\n\r\n", "size": 1, "showAnalytics": true, "title": "Network port changes ", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "network" }, "name": "Network port changes " }, { "type": 1, "content": { "json": "#### VM Public IP Assignment Changes: Threat Actor can assign Public IP to a VM and expose it to internet for any unauthorized access. Review the Public IP changes in your environment.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "vmpubliciptxt", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let OperationNames = dynamic([\"microsoft.compute/virtualMachines/write\", \"microsoft.resources/deployments/write\"]);\r\nAzureActivity\r\n// We look for any Operation that modified and then was accepted or succeeded where a publicipaddress component is referenced\r\n| where OperationNameValue in~ (OperationNames)\r\n| where ActivityStatusValue has_any (\"Succeeded\", \"Accepted\")\r\n| where Properties contains \"publicipaddress\"\r\n//| extend frontendIPConfigurations = Properties.responseBody.properties.frontendIPConfigurations\r\n// parsing the publicIPAddress from Properties. It is only available if the allocation method is Static.\r\n| parse Properties with * \"publicIPAddress\\\\\" PublicIPAddressParse\r\n| extend publicIPAddress_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).ipAddress) \r\n| extend publicIPAddressVersion_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAddressVersion) \r\n| extend publicIPAllocationMethod_ = tostring(parse_json(tostring(parse_json(tostring(parse_json(Properties).responseBody)).properties)).publicIPAllocationMethod) \r\n| extend scope_ = tostring(parse_json(Authorization).scope) \r\n| project\r\n TimeGenerated,\r\n OperationNameValue,\r\n publicIPAllocationMethod_,\r\n publicIPAddressVersion_,\r\n scope_,\r\n Caller,\r\n CallerIpAddress,\r\n ActivityStatusValue,\r\n Resource \r\n", "size": 1, "showAnalytics": true, "title": "VM Public IP Assignment Changes", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "compute" }, "name": "VM Public IP Assignment Changes" }, { "type": 1, "content": { "json": "#### Consent to Malicious Application: Threat Actor may lure a victim into giving their access to a malicious application registered in AzureAD. Review the Consent permissions and Target resource. in your environment.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/InitialAccess/AZT203/AZT203/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "vmpubliciptxt - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": " AuditLogs\r\n | where OperationName has \"Consent to application\"\r\n | extend\r\n Actor = tostring(InitiatedBy.user.userPrincipalName),\r\n ActorId = tostring(InitiatedBy.user.id),\r\n ActorIPAddress = tostring(InitiatedBy.user.ipAddress)\r\n | mv-expand TargetResource = TargetResources\r\n | extend\r\n AppDisplayName = tostring(TargetResource.displayName),\r\n AppServicePrincipalId = tostring(TargetResource.id)\r\n | mv-apply Properties = TargetResource.modifiedProperties on (\r\n summarize BagToUnpack = make_bag(pack(tostring(Properties.displayName), pack(\"oldValue\", Properties.oldValue, \"newValue\", Properties.newValue)))\r\n )\r\n | evaluate bag_unpack(BagToUnpack, columnsConflict='replace_source')\r\n | extend\r\n AdminConsent = trim(@'[\\\"\\s]+', tostring(column_ifexists(\"ConsentContext.IsAdminConsent\", dynamic(null)).newValue)),\r\n OnBehalfOfAllUsers = trim(@'[\\\"\\s]+', tostring(column_ifexists(\"ConsentContext.OnBehalfOfAll\", dynamic(null)).newValue)),\r\n AppId = extract(@\"([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\", 1, trim(@'[\\\"\\s]+', tostring(column_ifexists(\"TargetId.ServicePrincipalNames\", dynamic(null)).newValue))),\r\n Permissions = extract_all(@\"PrincipalId: ([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})?, ResourceId: ([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}), ConsentType:\\s+(\\w+), Scope:\\s+([^,]+)\", extract(@\"\\=\\>\\s+(.*)\", 1, tostring(column_ifexists(\"ConsentAction.Permissions\", \"\"))))\r\n | mv-apply Permissions on (\r\n extend\r\n TargetId = tostring(Permissions[0]),\r\n PermissionsResourceId = tostring(Permissions[1]),\r\n ConsentType = tostring(Permissions[2]),\r\n Scope = split(Permissions[3], ' ')\r\n | mv-expand Scope\r\n | summarize Permissions = array_sort_asc(make_set(Scope)) by ConsentType, TargetId, PermissionsResourceId\r\n )\r\n | extend Target = iff(TargetId == ActorId, Actor, \"\")\r\n", "size": 0, "showAnalytics": true, "title": "Consent to Application", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "applicationconsent" }, { "type": 1, "content": { "json": "#### Privileged Role Activation: An adversary may escalate their privileges if their current account is eligible for role activation via Privileged Identity Management (PIM). Review the PIM Role Activations in your environment.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT401/AZT401/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "vmpubliciptxt - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName in~ (\"Add member to role completed (PIM activation)\", \"Add member to role outside of PIM\")\r\n//| extend User = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n//| extend ['Azure AD Role Name'] = tostring(TargetResources[0].displayName)\r\n//| project TimeGenerated, User, ['Azure AD Role Name'], ['Activation Reason']=ResultReason\r\n| extend RoleName = tostring(TargetResources[0].displayName)\r\n| extend UserAdded = tostring(TargetResources[2].displayName)\r\n| extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n| project TimeGenerated, OperationName, RoleName, UserAdded, Actor, ['Activation Reason']=ResultReason", "size": 0, "showAnalytics": true, "title": "Privileged Role Activation", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "PIMRoleActivation" }, { "type": 1, "content": { "json": "#### Azure RBAC Elevate Access: An adversary may escalate their privileges from Azure AD to all Azure subscriptions in the tenant if they are a global administrator. Review the Elevate Access Activations in your environment.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT402/AZT402/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "ElevateAccess", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where Category =~ \"AzureRBACRoleManagementElevateAccess\"\r\n| where ActivityDisplayName =~ \"User has elevated their access to User Access Administrator for their Azure Resources\"\r\n| extend Actor = tostring(InitiatedBy.user.userPrincipalName)\r\n| extend IPAddress = tostring(InitiatedBy.user.ipAddress) \r\n| project TimeGenerated, Actor, OperationName, IPAddress, Result, LoggedByService", "size": 0, "showAnalytics": true, "title": "Azure RBAC Elevate Access", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "ElevateAccess" }, { "type": 1, "content": { "json": "#### Update Permission: An adversary may add permissions to Applications for persistence. Review the permissions added to Applications in your environment.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT405/AZT405/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "ElevateAccess - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let delegatedaccess=\r\n AuditLogs\r\n | where OperationName has \"Add delegated permission grant\"\r\n | extend x = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[0].newValue)))\r\n | extend ['Permissions granted'] = split(x, ' ')\r\n | extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n | extend ['Service Principal ObjectId'] = tostring(TargetResources[1].id)\r\n | extend Activity = strcat(\"Delegated access added to application\")\r\n | project\r\n TimeGenerated,\r\n Activity,\r\n ['Permissions granted'],\r\n ['Service Principal ObjectId'],\r\n Actor;\r\nlet appaccess=\r\n AuditLogs\r\n | where OperationName has \"Add app role assignment to service principal\"\r\n | extend x = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))\r\n | extend ['Permissions granted'] = split(x, ' ')\r\n | extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n | extend Activity = strcat(\"Application access added to application\")\r\n | extend ['Service Principal ObjectId'] = tostring(TargetResources[1].id)\r\n | project\r\n TimeGenerated,\r\n Activity,\r\n ['Permissions granted'],\r\n ['Service Principal ObjectId'],\r\n Actor;\r\nunion delegatedaccess, appaccess", "size": 0, "showAnalytics": true, "title": "Add Application or delegated permission", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Add Application Permission" }, { "type": 1, "content": { "json": "#### Update certificates or secrets: An adversary may update certificates or secrets to Applications for persistence. Review the update to certificates or secrets in Applications in your environment.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT405/AZT405/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "ElevateAccess - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where Category == \"ApplicationManagement\"\r\n| where OperationName == \"Update application – Certificates and secrets management \"\r\n| where Result == \"success\"\r\n| extend UserPrincipalName = InitiatedBy.user.userPrincipalName\r\n| extend IPAddress = InitiatedBy.user.ipAddress\r\n| extend AppDisplayName = TargetResources[0].displayName\r\n| extend UserAgent = AdditionalDetails[0].value\r\n| project TimeGenerated, UserPrincipalName, OperationName, IPAddress, AppDisplayName, UserAgent\r\n", "size": 0, "showAnalytics": true, "title": "Update application – Certificates and secrets management", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Update certficates or secrets" }, { "type": 1, "content": { "json": "#### Update Security Info:An adversary may update security Info (MFA Method) for persistence. Review the Security Info changes in your environment.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "ElevateAccess - Copy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName in~ (\"Admin registered security info\", \"Admin updated security info\", \"Admin deleted security info\", \"User registered security info\", \"User changed default security info\", \"User deleted security info\")\r\n| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n| project TimeGenerated, OperationName, UserPrincipalName", "size": 0, "showAnalytics": true, "title": "Security Info Changes", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Security Info Changes" }, { "type": 1, "content": { "json": "#### TAP Registration: An adversary may create Temporary Access Password (TAP) for persistence. Review the TAP changes in your environment.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "TAP", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName in~ (\"Admin registered security info\", \"Admin updated security info\", \"Admin deleted security info\", \"User registered security info\", \"User changed default security info\", \"User deleted security info\")\r\n| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n| project TimeGenerated, OperationName, UserPrincipalName", "size": 0, "showAnalytics": true, "title": "Temporary Access Password Registration", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "TAP" }, { "type": 1, "content": { "json": "#### CA Policy Manipulation: An adversary may update Conditional Access Policy for persistence. Review the CA Policy changes in your environment.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "CA Policy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where TimeGenerated > ago(1d)\r\n| where OperationName in (\"Update conditional access policy\", \"Add conditional access policy\", \"Delete conditional access policy\")\r\n| extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n| extend ['Policy Name'] = tostring(TargetResources[0].displayName)\r\n| extend ['Policy Id'] = tostring(TargetResources[0].id)\r\n| project TimeGenerated, Actor, ['Policy Name'], ['Policy Id']", "size": 0, "showAnalytics": true, "title": "Conditional Access policy Changes", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Conditional Access policy Changes" }, { "type": 1, "content": { "json": "#### Account Manipulation- An adversary may update user properties for disguise or persistence. Review the changes to Users properties in your environment.Reference- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT501/AZT501/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "CA Policy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where Category == \"UserManagement\"// and OperationName has_any (\"Update user\")\r\n//| where TargetResources has_any (\"Guest\", \"#EXT#\")\r\n| mv-expand TargetResource = TargetResources\r\n| where TargetResource[\"type\"] == \"User\"\r\n| mv-apply modifiedProperty = TargetResource[\"modifiedProperties\"] on (\r\n summarize modifiedProperties = make_bag(\r\n bag_pack(tostring(modifiedProperty[\"displayName\"]),\r\n bag_pack(\"oldValue\", trim(@'[\\\"\\s]+', tostring(modifiedProperty[\"oldValue\"])),\r\n \"newValue\", trim(@'[\\\"\\s]+', tostring(modifiedProperty[\"newValue\"])))))\r\n )\r\n| where case(\r\n isnotempty(modifiedProperties[\"TargetId.UserType\"][\"oldValue\"]) and tostring(modifiedProperties[\"TargetId.UserType\"][\"oldValue\"]) != tostring(modifiedProperties[\"TargetId.UserType\"][\"newValue\"]), true,\r\n tostring(modifiedProperties[\"UserType\"][\"oldValue\"]) != \"[]\" and tostring(modifiedProperties[\"UserType\"][\"oldValue\"]) != tostring(modifiedProperties[\"UserType\"][\"newValue\"]), true,\r\n tostring(modifiedProperties[\"UserPrincipalName\"][\"oldValue\"]) != \"[]\" and tostring(modifiedProperties[\"UserPrincipalName\"][\"oldValue\"]) != tostring(modifiedProperties[\"UserPrincipalName\"][\"newValue\"]), true,\r\n false\r\n)\r\n| extend\r\n Initiator = iif(isnotempty(InitiatedBy[\"app\"]), tostring(InitiatedBy[\"app\"][\"displayName\"]), tostring(InitiatedBy[\"user\"][\"userPrincipalName\"])),\r\n InitiatorId = iif(isnotempty(InitiatedBy[\"app\"]), tostring(InitiatedBy[\"app\"][\"servicePrincipalId\"]), tostring(InitiatedBy[\"user\"][\"id\"])),\r\n IPAddress = tostring(InitiatedBy[tostring(bag_keys(InitiatedBy)[0])][\"ipAddress\"]),\r\n TargetUserPrincipalName = tostring(TargetResource[\"userPrincipalName\"]),\r\n TargetId = tostring(TargetResource[\"id\"])\r\n| project\r\n TimeGenerated,\r\n Category,\r\n Identity,\r\n Initiator,\r\n IPAddress,\r\n OperationName,\r\n Result,\r\n TargetUserPrincipalName,\r\n InitiatorId,\r\n TargetId,\r\n InitiatedBy,\r\n AdditionalDetails,\r\n TargetResources,\r\n CorrelationId", "size": 0, "showAnalytics": true, "title": "Review Modified Properties for User Account ", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "User Properties Update " }, { "type": 1, "content": { "json": "#### Account Creation- An adversary may create account for disguise or persistence purpose. Review the changes to accounts in your environment.Reference- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT502/AZT502/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "CA Policy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName =~ \"Add service principal\"\r\n| extend Actor = tostring(parse_json(tostring(InitiatedBy.app)).displayName)\r\n| extend ['Service Principal DisplayName'] = tostring(TargetResources[0].displayName)\r\n| extend ['Service Principal Id'] = tostring(TargetResources[0].id)\r\n| project TimeGenerated, ['Service Principal DisplayName'], ['Service Principal Id'], Actor", "size": 0, "showAnalytics": true, "title": "Review Service Principal Added", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Add Service Principal" }, { "type": 1, "content": { "json": "#### Account Creation- An adversary may create account for disguise or persistence purpose. Review the changes to accounts in your environment.Reference- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT502/AZT502/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "CA Policy - Copy - Copy - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName =~ \"Add user\"\r\n| extend Actor = tostring(parse_json(tostring(InitiatedBy.app)).displayName)\r\n| extend ['Service Principal DisplayName'] = tostring(TargetResources[0].displayName)\r\n| extend ['Service Principal Id'] = tostring(TargetResources[0].id)\r\n| project TimeGenerated, ['Service Principal DisplayName'], ['Service Principal Id'], Actor", "size": 0, "showAnalytics": true, "title": "Review User Accounts Added", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Add Service Principal - Copy" }, { "type": 1, "content": { "json": "#### Account Creation- An adversary may add Guest Users for persistence. Review the Guest Users invite in your environment.Reference: https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT502/AZT502-3/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "CA Policy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName in (\"Redeem external user invite\", \"Invite external user\")", "size": 0, "showAnalytics": true, "title": "Guest User Invite Activity", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Guest User Invite" }, { "type": 1, "content": { "json": "#### Account Creation- An adversary may create application for disguise or persistence purpose. Review the changes to application in your environment.Reference- https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT502/AZT502/", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "ElevateAccess - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where TimeGenerated > ago(7d)\r\n| where Category == \"ApplicationManagement\"\r\n| where OperationName == \"Add application\"\r\n| where Result == \"success\"\r\n| extend UserPrincipalName = InitiatedBy.user.userPrincipalName\r\n| extend UserId = tostring(InitiatedBy.user.id)\r\n| extend IPAddress = InitiatedBy.user.ipAddress\r\n| extend AppDisplayName = TargetResources[0].displayName\r\n| extend UserAgent = AdditionalDetails[0].value\r\n//| join kind=leftouter ( \r\n   // AADUserRiskEvents\r\n   // | where TimeGenerated >ago(7d)\r\n  //  | summarize Risks = make_set(RiskEventType), FirstRisk = min(TimeGenerated), LastRisk = max(TimeGenerated) by UserId\r\n//) on UserId\r\n//| project TimeGenerated, UserId, IPAddress, AppDisplayName, UserAgent, Risks, FirstRisk, LastRisk\r\n| project TimeGenerated, UserId, IPAddress, AppDisplayName, UserAgent", "size": 0, "showAnalytics": true, "title": "Add Application", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Add Application" }, { "type": 1, "content": { "json": "#### Rogue Device Registration- An adversary may register rogue devices for persistence purpose. Review the device registration changes in your environment.", "style": "warning" }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "ElevateAccess - Copy - Copy", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "AuditLogs\r\n| where OperationName in~ (\"Register device\", \"Unregister device\")", "size": 0, "showAnalytics": true, "title": " Device Regitration Changes", "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ "{Workspace}" ] }, "conditionalVisibility": { "parameterName": "wbtab", "comparison": "isEqualTo", "value": "identity" }, "name": "Rogue Device regitration" } ], "fallbackResourceIds": [ "azure monitor" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }