Rare Azure Activity Logs Event Failures

A machine learning job detected an unusual failure in an Azure Activity Logs message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.

Rule type: machine_learning
Rule indices:

Rule Severity: low
Risk Score: 21
Runs every: 15m
Searches indices from: now-2h
Maximum alerts per execution: ?
References:

• https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html

Tags:

• Domain: Cloud
• Data Source: Azure
• Data Source: Azure Activity Logs
• Rule Type: ML
• Rule Type: Machine Learning

Version: ?
Rule authors:

• Elastic

Rule license: Elastic License v2

This rule requires the installation of associated Machine Learning jobs, as well as data coming in from Azure Activity Logs.

Once the rule is enabled, the associated Machine Learning job will start automatically. You can view the Machine Learning job linked under the "Definition" panel of the detection rule. If the job does not start due to an error, the issue must be resolved for the job to commence successfully. For more details on setting up anomaly detection jobs, refer to the helper guide.

The Azure Activity Logs integration allows you to collect logs and metrics from Azure with Elastic Agent.

• Go to the Kibana home page and click “Add integrations”.
• In the query bar, search for “Azure Activity Logs” and select the integration to see more details about it.
• Click “Add Azure Activity Logs”.
• Configure the integration.
• Click “Save and Continue”.
• For more details on the integration refer to the helper guide.

Framework: MITRE ATT&CK

• Tactic:

  • Name: Discovery
  • Id: TA0007
  • Reference URL: https://attack.mitre.org/tactics/TA0007/

• Technique:

  • Name: Cloud Service Discovery
  • Id: T1526
  • Reference URL: https://attack.mitre.org/techniques/T1526/

• Technique:

  • Name: Cloud Infrastructure Discovery
  • Id: T1580
  • Reference URL: https://attack.mitre.org/techniques/T1580/

Framework: MITRE ATT&CK

• Tactic:
  • Name: Privilege Escalation
  • Id: TA0004
  • Reference URL: https://attack.mitre.org/tactics/TA0004/

Framework: MITRE ATT&CK

• Tactic:
  • Name: Defense Evasion
  • Id: TA0005
  • Reference URL: https://attack.mitre.org/tactics/TA0005/

Framework: MITRE ATT&CK

• Tactic:
  • Name: Lateral Movement
  • Id: TA0008
  • Reference URL: https://attack.mitre.org/tactics/TA0008/

Framework: MITRE ATT&CK

• Tactic:
  • Name: Persistence
  • Id: TA0003
  • Reference URL: https://attack.mitre.org/tactics/TA0003/

Framework: MITRE ATT&CK

• Tactic:
  • Name: Collection
  • Id: TA0009
  • Reference URL: https://attack.mitre.org/tactics/TA0009/