analyzing-azure-activity-logs-for-threats

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Analyzing Azure Activity Logs for Threats

分析Azure活动日志以检测威胁

When to Use

适用场景

When investigating security incidents that require analyzing azure activity logs for threats
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

当调查需要分析Azure活动日志来检测威胁的安全事件时
当针对该领域构建检测规则或威胁狩猎查询时
当SOC分析师需要此类分析的结构化流程时
当验证相关攻击技术的安全监控覆盖范围时

Prerequisites

前提条件

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

熟悉安全运营概念与工具
可访问测试或实验室环境以安全执行操作
安装Python 3.8及以上版本并配置好所需依赖
拥有测试活动所需的适当授权

Instructions

操作步骤

Use azure-monitor-query to execute KQL queries against Azure Log Analytics workspaces, detecting suspicious admin operations and sign-in anomalies.

python

from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from datetime import timedelta

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

response = client.query_workspace(
    workspace_id="WORKSPACE_ID",
    query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
    timespan=timedelta(hours=24),
)

Key detection queries:

Role assignment changes (privilege escalation)
Resource group and subscription modifications
Key vault secret access from new IPs
Network security group rule changes
Conditional access policy modifications

使用azure-monitor-query对Azure Log Analytics工作区执行KQL查询，检测可疑的管理员操作和登录异常。

python

from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from datetime import timedelta

credential = DefaultAzureCredential()
client = LogsQueryClient(credential)

response = client.query_workspace(
    workspace_id="WORKSPACE_ID",
    query="AzureActivity | where OperationNameValue has 'MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE' | take 10",
    timespan=timedelta(hours=24),
)

核心检测查询：

角色分配变更（权限提升）
资源组与订阅修改
来自新IP的密钥保管库机密访问
网络安全组规则变更
条件访问策略修改

Examples

示例

python

undefined

python

undefined

Detect new Global Admin role assignments

query = ''' AuditLogs | where OperationName == "Add member to role" | where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator" '''

undefined

query = ''' AuditLogs | where OperationName == "Add member to role" | where TargetResources[0].modifiedProperties[0].newValue has "Global Administrator" '''

undefined