OWASP Analyzing Azure Activity Logs for Threats
When to Use
- When investigating suspicious administrative activity in an Azure subscription.
- When performing a post-incident forensic analysis of a compromised tenant.
- When building custom KQL analytics rules for Microsoft Sentinel.
- When hunting for signs of privilege escalation or persistence.
Key Concepts
| Term | Definition |
|---|---|
| AzureActivity | Log table containing all administrative (write/delete) operations in Azure |
| SigninLogs | Log table containing all user and service principal authentication events |
| KQL | Kusto Query Language, used to query Azure Monitor and Sentinel data |
| Resource Provider | The Azure service (e.g., Microsoft.Compute) that performed the logged action |
OpenShield Visibility Rules
OpenShield helps ensure you have the visibility required for these queries:
- Logging:
AZ-STOR-004(Diagnostic Logs),AZ-IDN-009(Assignment Alerts) - Identity:
AZ-IDN-007(MFA Status),AZ-IDN-002(Conditional Access)
Hunting Queries (KQL)
1. Detect Suspicious Role Assignments
AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatusValue == "Succeeded"
| extend Role = tostring(parse_json(Properties).roleDefinitionId)
2. Detect Cross-Tenant Data Access
StorageBlobLogs
| where OperationName == "GetBlob"
| where CallerIpAddress !in ("List_of_Trusted_IPs")
3. Detect Key Vault Secret Access
AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT"
| where OperationName in ("SecretGet", "KeyGet")
Remediation Reference
- Centralize Logs: Send all subscription logs to a central Log Analytics workspace.
- Set Alerts: Create analytics rules in Sentinel based on these queries for real-time alerting.
- Harden RBAC: Limit who can perform the
Microsoft.Authorization/roleAssignments/writeoperation.