원클릭으로 Manus에서 모든 스킬 실행

analyzing-azure-activity-logs-for-threats

스타54

포크65

업데이트2026년 6월 21일 23:49

Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

openshield-org

openshield-org/openshield

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Analyzing Azure Activity Logs for Threats

When to Use

When investigating suspicious administrative activity in an Azure subscription.
When performing a post-incident forensic analysis of a compromised tenant.
When building custom KQL analytics rules for Microsoft Sentinel.
When hunting for signs of privilege escalation or persistence.

Key Concepts

Term	Definition
AzureActivity	Log table containing all administrative (write/delete) operations in Azure
SigninLogs	Log table containing all user and service principal authentication events
KQL	Kusto Query Language, used to query Azure Monitor and Sentinel data
Resource Provider	The Azure service (e.g., Microsoft.Compute) that performed the logged action

OpenShield Visibility Rules

OpenShield helps ensure you have the visibility required for these queries:

Logging: AZ-STOR-004 (Diagnostic Logs), AZ-IDN-009 (Assignment Alerts)
Identity: AZ-IDN-007 (MFA Status), AZ-IDN-002 (Conditional Access)

Hunting Queries (KQL)

1. Detect Suspicious Role Assignments

AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatusValue == "Succeeded"
| extend Role = tostring(parse_json(Properties).roleDefinitionId)

2. Detect Cross-Tenant Data Access

StorageBlobLogs
| where OperationName == "GetBlob"
| where CallerIpAddress !in ("List_of_Trusted_IPs")

3. Detect Key Vault Secret Access

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT"
| where OperationName in ("SecretGet", "KeyGet")

Remediation Reference

Centralize Logs: Send all subscription logs to a central Log Analytics workspace.
Set Alerts: Create analytics rules in Sentinel based on these queries for real-time alerting.
Harden RBAC: Limit who can perform the Microsoft.Authorization/roleAssignments/write operation.

이 저장소의 다른 Skills

같은 저장소

post-quantum-cryptography-azure

openshield-org/openshield

Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.

2026-07-1454

analyzing-cloud-storage-access-patterns

openshield-org/openshield

Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.

2026-06-2154

auditing-azure-active-directory-configuration

openshield-org/openshield

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.

2026-06-2154

auditing-cloud-with-cis-benchmarks

openshield-org/openshield

Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.

2026-06-2154

building-cloud-siem-with-sentinel

openshield-org/openshield

Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.

2026-06-2154

building-identity-federation-with-saml-azure-ad

openshield-org/openshield

Establish SAML 2.0 identity federation between on-premises Active Directory and Microsoft Entra ID (Azure AD) for seamless cross-domain authentication and SSO.

2026-06-2154

name	analyzing-azure-activity-logs-for-threats
description	Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.
domain	cybersecurity
subdomain	security-operations
tags	["azure","monitoring","kql","threat-hunting","activity-logs"]
version	1.0
author	openshield
license	Apache-2.0
nist_csf	["DE.CM-1","DE.CM-3","DE.CM-7","DE.AE-3","RS.AN-1"]

Analyzing Azure Activity Logs for Threats

When to Use

When investigating suspicious administrative activity in an Azure subscription.
When performing a post-incident forensic analysis of a compromised tenant.
When building custom KQL analytics rules for Microsoft Sentinel.
When hunting for signs of privilege escalation or persistence.

Key Concepts

Term	Definition
AzureActivity	Log table containing all administrative (write/delete) operations in Azure
SigninLogs	Log table containing all user and service principal authentication events
KQL	Kusto Query Language, used to query Azure Monitor and Sentinel data
Resource Provider	The Azure service (e.g., Microsoft.Compute) that performed the logged action

OpenShield Visibility Rules

OpenShield helps ensure you have the visibility required for these queries:

Logging: AZ-STOR-004 (Diagnostic Logs), AZ-IDN-009 (Assignment Alerts)
Identity: AZ-IDN-007 (MFA Status), AZ-IDN-002 (Conditional Access)

Hunting Queries (KQL)

1. Detect Suspicious Role Assignments

AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatusValue == "Succeeded"
| extend Role = tostring(parse_json(Properties).roleDefinitionId)

2. Detect Cross-Tenant Data Access

StorageBlobLogs
| where OperationName == "GetBlob"
| where CallerIpAddress !in ("List_of_Trusted_IPs")

3. Detect Key Vault Secret Access

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT"
| where OperationName in ("SecretGet", "KeyGet")

Remediation Reference

Centralize Logs: Send all subscription logs to a central Log Analytics workspace.
Set Alerts: Create analytics rules in Sentinel based on these queries for real-time alerting.
Harden RBAC: Limit who can perform the Microsoft.Authorization/roleAssignments/write operation.