Azure Suspicious VM Automation Execution
Detection overview
Triggers
- Unusual execution of a VM Azure Runbook by an unexpected or unauthorized user/service principal.
- Unusual changes to Runbook execution permissions.
- Runbooks are being executed (deployed) for legitimate business use cases.
Possible Root Causes
- Compromised Principal Account: An attacker has gained access to a service principal or user account and is executing malicious Runbooks.
- Misconfigured Runbook: An administrator or developer has inadvertently created or modified a Runbook with unusual logic.
- Unauthorized Automation: Automated deployment scripts are updating or executing Runbooks without proper authorization.
- Legitimate Business Process: A valid business process involves running Runbooks, but execution frequency or parameters have been altered in an unexpected way.
Business Impact
- Exposure of sensitive data due to unauthorized access or data leaks.
- Security vulnerabilities exploited through misconfigured VMs or Runbooks.
- Disruption of critical business services and reputational damage due to unplanned system downtime.
- Unauthorized changes to business logic or workflows, leading to financial losses or compliance issues.
Steps to Verify
- Review Azure Activity Logs for the suspicious event, focusing on the user/service principal and the executed Runbook.
- Investigate the user�s or service principal�s permissions and access levels within Azure.
- Verify if other security alerts or notifications were triggered around the time of the suspicious event.
- Inspect the Runbook code for signs of malicious activity.
- To view the Runbook:
- Navigate to the Automation Accounts service in Azure.
- Identify the Automation Account associated with the Runbook.
- Locate the Runbooks under the Process Automation tab for the selected Automation Account.
- Consult with Azure administrators, security teams, and relevant stakeholders to determine the cause and scope of the incident.
- If the review indicates malicious actions, isolate the virtual machine for further investigation and remediation.
Azure Suspicious VM Automation Execution
Possible root causes
Malicious Detection
Benign Detection
Azure Suspicious VM Automation Execution
Example scenarios
Azure Suspicious VM Automation Execution
Business impact
If this detection indicates a genuine threat, the organization faces significant risks:
Azure Suspicious VM Automation Execution
Steps to investigate
Azure Suspicious VM Automation Execution
MITRE ATT&CK techniques covered
Azure Suspicious VM Automation Execution
Related detections
No items found.