Azure Activity Logs: High Rate of VM Creation or Deployment Writes

title: "Azure Activity Logs: High Rate of VM Creation or Deployment Writes"
id: e6c9bd4c-9775-47e5-b0ff-8104c880ecff
status: test
description: This rule identifies Azure activity log events indicating writes for virtual machine creation (Microsoft.Compute/virtualMachines/write) or deployment activity (Microsoft.Resources/deployments/write). Attackers may use resource creation or deployments to rapidly provision infrastructure for persistence, privilege escalation, or staging. The detection relies on Azure activity logs from the activitylogs service and matches the presence of the specified resource-provider write operations.
references:
  - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml
author: sawwinnnaung, Huntrule Team
date: 2020-05-07
modified: 2023-10-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1098
logsource:
  product: azure
  service: activitylogs
detection:
  keywords:
    - Microsoft.Compute/virtualMachines/write
    - Microsoft.Resources/deployments/write
  condition: keywords
falsepositives:
  - Valid change
level: medium
license: DRL-1.1
related:
  - id: d2d901db-7a75-45a1-bc39-0cbf00812192
    type: derived