Rare Subscription-level Operations In Azure

Title: Rare Subscription-level Operations In Azure
Status: test
Description:Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
References:
  -https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml
Author: sawwinnnaung
Date: 2020-05-07
modified:2023-10-11
Tags:

• -'attack.t1003'
• -'attack.credential-access'

Logsource:

• product: azure
• service: activitylogs

Detection:
  keywords:
    - 'Microsoft.DocumentDB/databaseAccounts/listKeys/action'
    - 'Microsoft.Maps/accounts/listKeys/action'
    - 'Microsoft.Media/mediaservices/listKeys/action'
    - 'Microsoft.CognitiveServices/accounts/listKeys/action'
    - 'Microsoft.Storage/storageAccounts/listKeys/action'
    - 'Microsoft.Compute/snapshots/write'
    - 'Microsoft.Network/networkSecurityGroups/write'
  condition:keywords
Falsepositives:
  -Valid change
Level: medium