Azure Activity Logs: Alert on Rare Subscription-Level Operations from New Source IPs

title: "Azure Activity Logs: Alert on Rare Subscription-Level Operations from New Source IPs"
id: 29cc27ba-9ce4-449e-bada-0b16c8074ce4
status: test
description: This rule flags Azure subscription activity when specific high-signal operations are performed from a source IP address not previously observed. Attackers may rely on uncommon administrative or key-related actions to gain access or modify resources, so rare source IP usage can indicate suspicious authorization activity. It relies on Azure Activity Logs events containing the listed operation keywords and the presence of an unseen source IP.
references:
  - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_rare_operations.yml
author: sawwinnnaung, Huntrule Team
date: 2020-05-07
modified: 2023-10-11
tags:
  - attack.t1003
  - attack.credential-access
logsource:
  product: azure
  service: activitylogs
detection:
  keywords:
    - Microsoft.DocumentDB/databaseAccounts/listKeys/action
    - Microsoft.Maps/accounts/listKeys/action
    - Microsoft.Media/mediaservices/listKeys/action
    - Microsoft.CognitiveServices/accounts/listKeys/action
    - Microsoft.Storage/storageAccounts/listKeys/action
    - Microsoft.Compute/snapshots/write
    - Microsoft.Network/networkSecurityGroups/write
  condition: keywords
falsepositives:
  - Valid change
level: medium
license: DRL-1.1
related:
  - id: c1182e02-49a3-481c-b3de-0fadc4091488
    type: derived