Azure Activity Logs: Cloud Shell Created via Microsoft.Portal/Consoles/Write

Alerts on Azure portal activity indicating a Cloud Shell console was created.

FreeUnreviewedSigmamediumv1

azure-activity-logs-cloud-shell-created-via-microsoft-portal-consoles-write-72af37e2

title: "Azure Activity Logs: Cloud Shell Created via Microsoft.Portal/Consoles/Write"
id: bf4b6781-9520-44b7-b99c-fd49639f132d
status: test
description: This rule flags Azure Activity Log events where a new Cloud Shell is created through the Azure portal using the operation MICROSOFT.PORTAL/CONSOLES/WRITE. Attackers may use Cloud Shell as an interactive execution environment to run commands within the Azure portal context. Detection relies on Azure Activity Log telemetry capturing the portal console creation operation name.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_new_cloudshell_created.yml
author: Austin Songer, Huntrule Team
date: 2021-09-21
modified: 2022-08-23
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName: MICROSOFT.PORTAL/CONSOLES/WRITE
  condition: selection
falsepositives:
  - A new cloudshell may be created by a system administrator.
level: medium
license: DRL-1.1
related:
  - id: 72af37e2-ec32-47dc-992b-bc288a2708cb
    type: derived

What it detects

This rule flags Azure Activity Log events where a new Cloud Shell is created through the Azure portal using the operation MICROSOFT.PORTAL/CONSOLES/WRITE. Attackers may use Cloud Shell as an interactive execution environment to run commands within the Azure portal context. Detection relies on Azure Activity Log telemetry capturing the portal console creation operation name.

Known false positives

A new cloudshell may be created by a system administrator.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.