Suspicious Number Of Resource Creation Or Deployment Activities (via activitylogs)

title: Suspicious Number Of Resource Creation Or Deployment Activities (via activitylogs)
id: 1d1297f6-6cc9-5c89-981a-797a08c4e20e
status: stable
description: This rule detects number of VM creations or deployment activities occur in Azure via the azureactivity log.
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml
author: Huntrule Team
date: 2026-03-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: azure
    service: activitylogs
detection:
    keywords:
        - Microsoft.Compute/virtualMachines/write
        - Microsoft.Resources/deployments/write
    condition: keywords
falsepositives:
    - Unknown
level: medium