huntrule

Azure Activity Logs: Alert on First-Time Source IP for Subscription-Level Rare Operations

Alerts when specified Azure subscription operations occur from a new, previously unseen source IP.

FreeReviewedSigma · Medium · v5
Product
azure
Service
activitylogs
Author
sawwinnnaung (SigmaHQ), DRL 1.1
Published
2020-05-07
Updated
2026-07-31
AnalysisDetection
title: "Azure Activity Logs: Alert on First-Time Source IP for Subscription-Level Rare Operations"
id: 29cc27ba-9ce4-449e-bada-0b16c8074ce4
status: test
description: This rule flags subscription-level Azure activity when a request originates from a source IP that has not been seen before. It focuses on rare operations such as listing access keys for multiple Azure resource types and write actions like snapshot creation and network security group changes. Unfamiliar source IPs can indicate new access paths or potential credential misuse, and the detection relies on Azure Activity Log event telemetry that includes the operation name and request source IP.
references:
  - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_rare_operations.yml
author: sawwinnnaung, Huntrule Team
date: 2020-05-07
modified: 2023-10-11
tags:
  - attack.t1003
  - attack.credential-access
logsource:
  product: azure
  service: activitylogs
detection:
  keywords:
    - Microsoft.DocumentDB/databaseAccounts/listKeys/action
    - Microsoft.Maps/accounts/listKeys/action
    - Microsoft.Media/mediaservices/listKeys/action
    - Microsoft.CognitiveServices/accounts/listKeys/action
    - Microsoft.Storage/storageAccounts/listKeys/action
    - Microsoft.Compute/snapshots/write
    - Microsoft.Network/networkSecurityGroups/write
  condition: keywords
falsepositives:
  - Valid change
level: medium
license: DRL-1.1
related:
  - id: c1182e02-49a3-481c-b3de-0fadc4091488
    type: derived