Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent

Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.

FreeReviewedSigma · High · v5

Product: azure
Service: signinlogs
Author: Janantha Marasinghe (SigmaHQ), DRL 1.1
Published: 2022-11-27
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1087.004Cloud Account
- T1526Cloud Service Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies activity consistent with AzureHound by matching the default User-Agent string used after a successful sign-in. Attackers often run AzureHound to enumerate Azure AD and related permissions for subsequent discovery and targeting. The detection relies on Azure sign-in log telemetry, specifically the User-Agent field and the ResultType indicating successful authentication.

Reporting behind it

Related detections8 linkedT1526 — drag to rearrange

Malicious Directory Enumeration With Recon Tooling User Agent via Azure AD Graph

Suspicious Azure CLI Enumeration of Roles and Logic Apps

Suspicious AWS Organizations and Account Discovery via aws (via cloudtrail)

Suspicious Anonymous Access to Kubernetes API Server via Audit Log

AWS CloudTrail Detects STS GetCallerIdentity Calls with TruffleHog User-Agent

Kubernetes RBAC SelfSubjectRulesReview Permission Enumeration Attempt

GitHub Audit Log: Self-Hosted Runner Configuration Changes

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent

Pivot detection · T1526 · 8 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-sign-in-logs-detect-azurehound-discovery-via-user-agent-after-successful-a-35b781cc

title: "Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent"
id: 38e586ac-6c82-4350-ada5-b20895084950
status: test
description: This rule identifies activity consistent with AzureHound by matching the default User-Agent string used after a successful sign-in. Attackers often run AzureHound to enumerate Azure AD and related permissions for subsequent discovery and targeting. The detection relies on Azure sign-in log telemetry, specifically the User-Agent field and the ResultType indicating successful authentication.
references:
  - https://github.com/BloodHoundAD/AzureHound
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml
author: Janantha Marasinghe, Huntrule Team
date: 2022-11-27
tags:
  - attack.discovery
  - attack.t1087.004
  - attack.t1526
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    userAgent|contains: azurehound
    ResultType: 0
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 35b781cc-1a08-4a5a-80af-42fd7c315c6b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL