Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Rare subscription-level operations in Azure

This query looks for a few sensitive subscription-level events based on Azure Activity Logs. For example, this monitors for the operation name 'Create or Update Snapshot', which is used for creating backups but could be misused by attackers to dump hashes or extract sensitive information from the disk.

ATT&CK coverage

Persistence

T1098Account ManipulationAlso under Privilege Escalation.272 detections cover this technique

Credential Access

T1003OS Credential Dumping 127 detections cover this technique

Detection requirements

Log source product: azureactivity
Log source service: azureactivity

What the source says

Tagged by the source as

CredentialAccessPersistence

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.