Detection rules › By catalog entry

Azure-Microsoft.Resources

Catalog entry	Rules
Microsoft.Resources/deployments/write	5
Microsoft.Resources/subscriptions/resourceGroups/delete	2
Microsoft.Resources/subscriptions/resourceGroups/write	1

Microsoft.Resources/deployments/write

5 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Number Of Resource Creation Or Deployment Activities severity medium T1098

Kusto (4)

Creation of expensive computes in Azure severity low T1578
NRT Creation of expensive computes in Azure severity medium T1578
Suspicious number of resource creation or deployment activities severity medium T1496
Suspicious Resource deployment severity low T1496

Microsoft.Resources/subscriptions/resourceGroups/delete

2 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Azure Resource Group Deleted severity medium T1485,T1489,T1490,T1529,T1685

Panther (1)

Azure Resource Group Deleted severity medium T1485

Microsoft.Resources/subscriptions/resourceGroups/write

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Suspicious Resource deployment severity low T1496

Back to all Azure-Microsoft.Resources catalog entries