Sunturai
Back to results
UnknownMicrosoft Sentinel analytics

Anomalous Code Execution on a Virtual Machine

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many…

Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. APT19, for example, used PowerShell commands to execute payloads. The query below generates an output of all users performing an "action" operation regarding "runCommand" in virtual machines, where one or more features of the activity deviate from the user, his peers, or the tenant profile.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
behavioranalytics
Log source service
behavioranalytics

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice