Creation of an anomalous number of resources

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Looks for anomalous number of resources creation or deployment activities in azure activity log. It is best to run this query on a look back period which is at least 7 days.

Attribute	Value
Type	Hunting Query
Solution	Azure Activity
ID	a09e6368-065b-4f1e-a4ce-b1b3a64b493b
Tactics	Impact
Techniques	T1496
Required Connectors	AzureActivity
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
AzureActivity	ActivityStatusValue == "Succeeded" OperationNameValue in "microsoft.compute/virtualMachines/write,microsoft.resources/deployments/write"	✗	✗	✗

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Azure Activity