Detect first time Azure Custom Script or Run Command deployment

Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This detection rule flags using UEBA of Defender XDR and Microsoft Sentinel if it is the first time that an account is deploying Custom Scripts or Run Commands on Azure and Azure Arc machines. Since UEBA uses a baseline of 180 days, it might indicate that an account is being abused to compormise Azure or Azure Arc machines.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1651` Cloud Administration Command
Lateral Movement	`T1021.008` Remote Services: Direct Cloud VM Connections

References

Rule body

BehaviorAnalytics
| where TimeGenerated > ago(1h)
| extend ActivityInsights = parse_json(ActivityInsights)
| where ActivityInsights.EventMessage has_any ('runCommand/action', 'extensions/write')
| where ActivityInsights.FirstTimeUserPerformedAction == "True"

Stages and Predicates

Stage 1: `source`

BehaviorAnalytics

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `extend`

| extend ActivityInsights = parse_json(ActivityInsights)

Stage 4: `where`

| where ActivityInsights.EventMessage has_any ('runCommand/action', 'extensions/write')

Stage 5: `where`

| where ActivityInsights.FirstTimeUserPerformedAction == "True"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventMessage`	match	`extensions/write` transforms: `term` `runCommand/action` transforms: `term`	`field:"EventMessage" kind:match`
`FirstTimeUserPerformedAction`	eq	`True`	`field:"FirstTimeUserPerformedAction" kind:eq value:"True"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActivityInsights`	`extend`