Detection rules › By event

Azure-Microsoft.Resources

Event	Rules
Microsoft.Resources/deployments/write	5
Microsoft.Resources/subscriptions/resourceGroups/delete	2
Microsoft.Resources/subscriptions/resourceGroups/write	1

Microsoft.Resources/deployments/write

5 detection rules reference this event. View event page.

Sigma (1)

Number Of Resource Creation Or Deployment Activities severity medium T1098

Kusto (4)

Creation of expensive computes in Azure severity low T1578
NRT Creation of expensive computes in Azure severity medium T1578
Suspicious number of resource creation or deployment activities severity medium T1496
Suspicious Resource deployment severity low T1496

Microsoft.Resources/subscriptions/resourceGroups/delete

2 detection rules reference this event. View event page.

Elastic (1)

Azure Resource Group Deleted severity medium T1485, T1489, T1490, T1529, T1685

Panther (1)

Azure Resource Group Deleted severity medium T1485

Microsoft.Resources/subscriptions/resourceGroups/write

1 detection rules reference this event. View event page.

Kusto (1)

Suspicious Resource deployment severity low T1496