Azure VM Run Command operation executed during suspicious login window

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identifies when the Azure Run Command operation is executed by a UserPrincipalName and IP Address that has resulted in a recent user entity behaviour alert.

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	11bda520-a965-4654-9a45-d09f372f71aa
Severity	High
Kind	Scheduled
Tactics	LateralMovement, CredentialAccess
Techniques	T1570, T1212
Required Connectors	AzureActivity, BehaviorAnalytics
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
AzureActivity	?	✗	?
BehaviorAnalytics	✓	✗	?

Associated Connectors

The following connectors provide data for this content item:

Connector	Solution
AzureActivity	Azure Activity

Solutions: Azure Activity

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules