detection.wiki

Detection rules › Kusto

Detect first time Azure Custom Script or Run Command deployment

Author
Robbe Van den Daele
Source
github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This detection rule flags using UEBA of Defender XDR and Microsoft Sentinel if it is the first time that an account is deploying Custom Scripts or Run Commands on Azure and Azure Arc machines. Since UEBA uses a baseline of 180 days, it might indicate that an account is being abused to compormise Azure or Azure Arc machines.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1651 Cloud Administration Command
Lateral MovementT1021.008 Remote Services: Direct Cloud VM Connections

References

Rule body yaml

BehaviorAnalytics
| where TimeGenerated > ago(1h)
| extend ActivityInsights = parse_json(ActivityInsights)
| where ActivityInsights.EventMessage has_any ('runCommand/action', 'extensions/write')
| where ActivityInsights.FirstTimeUserPerformedAction == "True"

Stages and Predicates

Stage 1: source

BehaviorAnalytics

Stage 2: where

| where TimeGenerated > ago(1h)

Stage 3: extend

| extend ActivityInsights = parse_json(ActivityInsights)

Stage 4: where

| where ActivityInsights.EventMessage has_any ('runCommand/action', 'extensions/write')

Stage 5: where

| where ActivityInsights.FirstTimeUserPerformedAction == "True"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventMessagematch
  • extensions/write
  • runCommand/action
FirstTimeUserPerformedActioneq
  • True transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
ActivityInsightsextend