Suspicious Creation of Azure Suppression Rule (via activitylogs)

This rule detects when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

SigmamediumCloudv1

sigma

suspicious-creation-of-azure-suppression-rule-via-activitylogs

title: Suspicious Creation of Azure Suppression Rule (via activitylogs)
id: 2c6a7a1b-7d47-551a-9777-8d70c74de9fa
status: stable
description: This rule detects when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
references:
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
author: Huntrule Team
date: 2026-07-05
tags:
    - attack.impact
    - attack.defense-evasion
    - attack.t1562.001
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName: MICROSOFT.SECURITY/ALERTSSUPPRESSIONRULES/WRITE
    condition: selection
falsepositives:
    - Unknown
level: medium

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.