analyzing-azure-activity-logs-for-threats

name	analyzing-azure-activity-logs-for-threats
description	Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.
domain	cybersecurity
subdomain	security-operations
tags	["azure","monitoring","kql","threat-hunting","activity-logs"]
version	1.0
author	openshield
license	Apache-2.0
nist_csf	["DE.CM-1","DE.CM-3","DE.CM-7","DE.AE-3","RS.AN-1"]

Analyzing Azure Activity Logs for Threats

When to Use

• When investigating suspicious administrative activity in an Azure subscription.
• When performing a post-incident forensic analysis of a compromised tenant.
• When building custom KQL analytics rules for Microsoft Sentinel.
• When hunting for signs of privilege escalation or persistence.

Key Concepts

Term	Definition
AzureActivity	Log table containing all administrative (write/delete) operations in Azure
SigninLogs	Log table containing all user and service principal authentication events
KQL	Kusto Query Language, used to query Azure Monitor and Sentinel data
Resource Provider	The Azure service (e.g., Microsoft.Compute) that performed the logged action

OpenShield Visibility Rules

OpenShield helps ensure you have the visibility required for these queries:

• Logging: AZ-STOR-004 (Diagnostic Logs), AZ-IDN-009 (Assignment Alerts)
• Identity: AZ-IDN-007 (MFA Status), AZ-IDN-002 (Conditional Access)

Hunting Queries (KQL)

1. Detect Suspicious Role Assignments

AzureActivity
| where OperationNameValue == "Microsoft.Authorization/roleAssignments/write"
| where ActivityStatusValue == "Succeeded"
| extend Role = tostring(parse_json(Properties).roleDefinitionId)

2. Detect Cross-Tenant Data Access

StorageBlobLogs
| where OperationName == "GetBlob"
| where CallerIpAddress !in ("List_of_Trusted_IPs")

3. Detect Key Vault Secret Access

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.KEYVAULT"
| where OperationName in ("SecretGet", "KeyGet")

Remediation Reference

• Centralize Logs: Send all subscription logs to a central Log Analytics workspace.
• Set Alerts: Create analytics rules in Sentinel based on these queries for real-time alerting.
• Harden RBAC: Limit who can perform the Microsoft.Authorization/roleAssignments/write operation.