Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Windows Entra User Management Via Azure CLI

This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user. Adversaries create new users so that their malicious activity does not interrupt the normal…

Description

This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user. Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected. While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Legitimate IT administrators commonly use the Azure CLI for managing user accounts. Filter alerts to exclude approved administrative or automated user management activities.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice