Azure VM Run Command operation executed during suspicious login window

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index


Identifies when the Azure Run Command operation is executed by a UserPrincipalName and IP Address that has resulted in a recent user entity behaviour alert.

Attribute Value
Type Analytic Rule
Solution Standalone Content
ID 11bda520-a965-4654-9a45-d09f372f71aa
Severity High
Kind Scheduled
Tactics LateralMovement, CredentialAccess
Techniques T1570, T1212
Required Connectors AzureActivity, BehaviorAnalytics
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AzureActivity Authorization has "virtualMachines"
OperationNameValue == "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION"
✗ ✗ ✗
BehaviorAnalytics EventSource == "Azure AD" ✓ ✗ ✗

Associated Connectors

The following connectors provide data for this content item:

Connector Solution
AzureActivity Azure Activity

Solutions: Azure Activity


Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules