Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Identifies any Azure VM Run Command operations and links these operations with MDE host logging. Linking these two data sources provides hunting opportunities. Logging from AzureActivity provides the IP address and UPN of the account that invoked the command. Joining this with logging from MDE provides insights into what cmdlets were loaded by the command.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | GitHub Only |
| ID | 55fbc363-6cc9-4201-bd68-d980b612082b |
| Tactics | LateralMovement, CredentialAccess |
| Techniques | T1570, T1078.004 |
| Required Connectors | AzureActivity, MicrosoftThreatProtection |
| Source | [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/MultipleDataSources/AzureRunCommandMDELinked.yaml) |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
AzureActivity |
Authorization has "virtualMachines"OperationNameValue == "Microsoft.Compute/virtualMachines/runCommand/action" |
✗ | ✗ | ✗ |
DeviceEvents |
✓ | ✗ | ✓ | |
DeviceFileEvents |
✓ | ✗ | ✓ |
The following connectors provide data for this content item:
| Connector | Solution |
|---|---|
| AzureActivity | Azure Activity |
Solutions: Azure Activity
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊