Detection rules › By event

Azure-Microsoft.Compute

Event	Rules
Microsoft.Compute/disks/beginGetAccess/action	1
Microsoft.Compute/disks/delete	1
Microsoft.Compute/galleries/applications/versions/write	1
Microsoft.Compute/restorePointCollections/delete	3
Microsoft.Compute/snapshots/delete	3
Microsoft.Compute/snapshots/write	2
Microsoft.Compute/virtualMachines/delete	1
Microsoft.Compute/virtualMachines/extensions/delete	1
Microsoft.Compute/virtualMachines/extensions/write	5
Microsoft.Compute/virtualMachines/retrieveBootDiagnosticsData/action	1
Microsoft.Compute/virtualMachines/runCommand/action	7
Microsoft.Compute/virtualMachines/runCommands/write	1
Microsoft.Compute/virtualMachines/write	7
Microsoft.Compute/virtualMachineScaleSets/extensions/delete	1
Microsoft.Compute/virtualMachineScaleSets/extensions/write	2
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action	2
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommands/write	1

Microsoft.Compute/disks/beginGetAccess/action

1 detection rules reference this event. View event page.

Panther (1)

Azure VM Disk SAS URI Generated severity high T1530, T1567.002

Microsoft.Compute/disks/delete

1 detection rules reference this event. View event page.

Panther (1)

Azure Disk Deleted severity informational T1485, T1490

Microsoft.Compute/galleries/applications/versions/write

1 detection rules reference this event. View event page.

Panther (1)

Azure VM Command Executed severity informational T1651

Microsoft.Compute/restorePointCollections/delete

3 detection rules reference this event. View event page.

Elastic (2)

Azure Compute Restore Point Collection Deleted by Unusual User severity medium T1490
Azure Compute Restore Point Collections Deleted severity high T1490

Panther (1)

Azure Restore Point Collection Deleted severity medium T1485, T1490

Microsoft.Compute/snapshots/delete

3 detection rules reference this event. View event page.

Elastic (2)

Azure Compute Snapshot Deletion by Unusual User and Resource Group severity low T1485, T1490
Azure Compute Snapshot Deletions by User severity medium T1485, T1490

Panther (1)

Azure VM Snapshot Deleted severity low T1485, T1490

Microsoft.Compute/snapshots/write

2 detection rules reference this event. View event page.

Sigma (1)

Rare Subscription-level Operations In Azure severity medium T1003

Kusto (1)

Rare subscription-level operations in Azure severity low T1003, T1098

Microsoft.Compute/virtualMachines/delete

1 detection rules reference this event. View event page.

Panther (1)

Azure Virtual Machine Deleted severity informational T1485, T1489

Microsoft.Compute/virtualMachines/extensions/delete

1 detection rules reference this event. View event page.

Elastic (1)

Azure VM Extension CRUD Operation with Unusual Source ASN severity medium T1037, T1651

Microsoft.Compute/virtualMachines/extensions/write

5 detection rules reference this event. View event page.

Elastic (3)

Azure VM Extension CRUD Operation with Unusual Source ASN severity medium T1037, T1651
Azure VM Extension Deployment by User severity medium T1098, T1578, T1578.002, T1651
Unusual Azure VM Extension Detected severity medium T1037, T1651

Kusto (1)

Detect Custom Script or Run Command deployment by risky user T1021, T1021.008, T1651

Panther (1)

Azure VM Command Executed severity informational T1651

Microsoft.Compute/virtualMachines/retrieveBootDiagnosticsData/action

1 detection rules reference this event. View event page.

Elastic (1)

Azure VM Boot Diagnostics Retrieved severity medium T1552

Microsoft.Compute/virtualMachines/runCommand/action

7 detection rules reference this event. View event page.

Elastic (2)

Azure Compute VM Command Executed severity medium T1651
Azure Run Command Correlated with Process Execution severity medium T1059, T1059.001, T1651

Kusto (4)

[AzureSubscription] Suspicious Azure VM Run Command Execution Detected severity high T1212, T1570
Azure VM Run Command operation executed during suspicious login window severity high T1212, T1570
Azure VM Run Command operations executing a unique PowerShell script severity medium T1059, T1059.001, T1570
Detect Custom Script or Run Command deployment by risky user T1021, T1021.008, T1651

Panther (1)

Azure VM Command Executed severity informational T1651

Microsoft.Compute/virtualMachines/runCommands/write

1 detection rules reference this event. View event page.

Elastic (1)

Azure VM Managed Run Command Created or Updated with Unusual Principal severity medium T1651

Microsoft.Compute/virtualMachines/write

7 detection rules reference this event. View event page.

Sigma (2)

Number Of Resource Creation Or Deployment Activities severity medium T1098
Virtual Machine Created severity informational

Elastic (1)

Azure Virtual Machine Configuration Modified severity low building block T1037, T1651

Kusto (4)

Creation of expensive computes in Azure severity low T1578
NRT Creation of expensive computes in Azure severity medium T1578
Suspicious number of resource creation or deployment activities severity medium T1496
Suspicious Resource deployment severity low T1496

Microsoft.Compute/virtualMachineScaleSets/extensions/delete

1 detection rules reference this event. View event page.

Elastic (1)

Azure VM Extension CRUD Operation with Unusual Source ASN severity medium T1037, T1651

Microsoft.Compute/virtualMachineScaleSets/extensions/write

2 detection rules reference this event. View event page.

Elastic (2)

Azure VM Extension CRUD Operation with Unusual Source ASN severity medium T1037, T1651
Unusual Azure VM Extension Detected severity medium T1037, T1651

Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action

2 detection rules reference this event. View event page.

Elastic (1)

Azure Compute VM Command Executed severity medium T1651

Panther (1)

Azure VM Command Executed severity informational T1651

Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommands/write

1 detection rules reference this event. View event page.

Elastic (1)

Azure VM Managed Run Command Created or Updated with Unusual Principal severity medium T1651