huntrule

Azure Sign-in Logs: Detect AzureHound Discovery via User-Agent After Successful Authentication

Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.

FreeUnreviewedSigmahighv1
title: "Azure Sign-in Logs: Detect AzureHound Discovery via User-Agent After Successful Authentication"
id: 38e586ac-6c82-4350-ada5-b20895084950
status: test
description: This rule identifies AzureHound discovery activity by matching the default User-Agent string containing "azurehound" in Azure sign-in logs. The behavior matters because AzureHound-style collection can be used to map Azure environments and exposed relationships after valid authentication. It relies on sign-in telemetry fields including the HTTP User-Agent and a successful ResultType indicator.
references:
  - https://github.com/BloodHoundAD/AzureHound
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml
author: Janantha Marasinghe, Huntrule Team
date: 2022-11-27
tags:
  - attack.discovery
  - attack.t1087.004
  - attack.t1526
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    userAgent|contains: azurehound
    ResultType: 0
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 35b781cc-1a08-4a5a-80af-42fd7c315c6b
    type: derived

What it detects

This rule identifies AzureHound discovery activity by matching the default User-Agent string containing "azurehound" in Azure sign-in logs. The behavior matters because AzureHound-style collection can be used to map Azure environments and exposed relationships after valid authentication. It relies on sign-in telemetry fields including the HTTP User-Agent and a successful ResultType indicator.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.