MediumSplunk security content Mauricio Velazco +2

Azure Automation Account Created

Description

The following analytic detects the creation of a new Azure Automation account within an Azure tenant. It leverages Azure Audit events, specifically the Azure Activity log category, to identify when an account is created or updated. This activity is significant because Azure Automation accounts can be used to automate tasks and orchestrate actions across Azure and on-premise environments. If an attacker creates an Automation account with elevated privileges, they could maintain persistence, execute malicious runbooks, and potentially escalate privileges or execute code on virtual machines, posing a significant security risk.

Detection logic

Detection requirements

Platform: IaaS Identity Provider Office Suite SaaS
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: azure_audit_create_or_update_an_azure_automation_account

Known benign triggers

Administrators may legitimately create Azure Automation accounts. Filter as needed.

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
attack.mitre.org/techniques/T1136/003/	Taxonomy	9
docs.microsoft.com/en-us/azure/automation/automation-create-standalone-account?tabs=azureportal	Product documentation	Only this detection cites it
docs.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker	Product documentation	Only this detection cites it
docs.microsoft.com/en-us/azure/automation/overview	Product documentation	3
microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/	Unclassified	3
www.inversecos.com/2021/12/how-to-detect-malicious-azure.html	Unclassified	3
www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/	Unclassified	3

Detection rules

Azure Automation Account Created

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules