원클릭으로 Manus에서 모든 스킬 실행

시작하기

analyzing-azure-activity-logs-for-threats

스타1

포크0

업데이트2026년 4월 4일 19:33

">"

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

YomMongkolphanna

YomMongkolphanna/SECURITY_BRAIN

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Analyzing Azure Activity Logs for Threats

When to Use

When investigating security incidents that require analyzing azure activity logs for threats
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces, detecting suspicious admin operations and sign-in anomalies.

from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from datetime import timedelta

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

response = client.query_workspace(
    workspace_id="WORKSPACE_ID",
    query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
    timespan=timedelta(hours=24),
)

Key detection queries:

Role assignment changes (privilege escalation)
Resource group and subscription modifications
Key vault secret access from new IPs
Network security group rule changes
Conditional access policy modifications

Examples

# Detect new Global Admin role assignments
query = '''
AuditLogs
| where OperationName == "Add member to role"
| where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator"
'''

이 저장소의 다른 Skills

같은 저장소

command-injection

YomMongkolphanna/SECURITY_BRAIN

Command injection testing methodology covering OS command injection, code injection, filter evasion, blind command injection, and shell-specific techniques for bash, PowerShell, and cmd.exe.

2026-04-301

exploit-chaining

YomMongkolphanna/SECURITY_BRAIN

Multi-step exploit chaining methodology for combining low-severity findings into full compromise paths. Covers attack chain scoring, approval gates, and systematic approach to turning individual findings into complete attack paths.

2026-04-301

privilege-escalation

YomMongkolphanna/SECURITY_BRAIN

Comprehensive privilege escalation methodology for Linux and Windows. Covers kernel exploits, SUID binaries, service misconfigurations, credential harvesting, and both local privilege escalation paths.

2026-04-301

recon-methodology

YomMongkolphanna/SECURITY_BRAIN

Comprehensive reconnaissance methodology covering OSINT, subdomain enumeration, technology fingerprinting, DNS reconnaissance, and attack surface mapping. Includes passive and active recon techniques with OPSEC considerations.

2026-04-301

sqli-testing

YomMongkolphanna/SECURITY_BRAIN

Comprehensive SQL injection testing methodology covering Union-based, Error-based, Blind (Boolean/Time-based), Stacked queries, and WAF bypass techniques. Includes database-specific payloads for MySQL, PostgreSQL, MSSQL, Oracle, SQLite, and NoSQL injection.

2026-04-301

ssrf-testing

YomMongkolphanna/SECURITY_BRAIN

Comprehensive Server-Side Request Forgery (SSRF) testing methodology covering basic SSRF, blind SSRF, DNS rebinding, cloud metadata exploitation, and gopher/redis attacks. Includes bypass techniques and automation.

2026-04-301

name	analyzing-azure-activity-logs-for-threats
description	>

Analyzing Azure Activity Logs for Threats

When to Use

When investigating security incidents that require analyzing azure activity logs for threats
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces, detecting suspicious admin operations and sign-in anomalies.

from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from datetime import timedelta

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

response = client.query_workspace(
    workspace_id="WORKSPACE_ID",
    query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
    timespan=timedelta(hours=24),
)

Key detection queries:

Role assignment changes (privilege escalation)
Resource group and subscription modifications
Key vault secret access from new IPs
Network security group rule changes
Conditional access policy modifications

Examples

# Detect new Global Admin role assignments
query = '''
AuditLogs
| where OperationName == "Add member to role"
| where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator"
'''