AzureVmRunCommandOrCustomScriptExecutionDetected.yaml

id: 5354125d-37a5-41d2-b065-2ea38194a51d
name: Azure VM Run Command or Custom Script execution detected
version: 1.0.0
kind: Scheduled
description: A user has either initiated a Azure VM Run Command or Custom Script execution
severity: Medium
queryFrequency: 30m
queryPeriod: 35m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - LateralMovement
relevantTechniques:
  - T1059
query: |-
  AzureActivity 
  | where CategoryValue == "Administrative"
  | where OperationNameValue =~ "Microsoft.Compute/virtualMachines/runCommand/action"
  | extend VMName = tostring(todynamic(Properties).resource)
  | summarize make_list(ActivityStatusValue), TimeGenerated = max(TimeGenerated) by CorrelationId, CallerIpAddress, Caller, ResourceGroup, VMName
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: Caller
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: VMName
suppressionDuration: 5h