Field	Type	Detection use
`operationName`	string	ARM operation (e.g. `Microsoft.Compute/virtualMachines/write`)
`caller`	string	UPN (user) or GUID (service principal)
`callerIpAddress`	string	Source IP
`status`	string	`Started`, `Succeeded`, `Failed`
`category`	string	`Administrative`, `Security`, `ServiceHealth`, `Policy`
`resourceId`	string	Full ARM resource path
`level`	string	`Informational`, `Warning`, `Error`, `Critical`
`claims`	object	JWT claims including `appid` (application ID), `oid` (object ID), `tid` (tenant ID)

Column names in your SIEM may differ from the Activity Log JSON field names. Consult your SIEM's Azure connector documentation for exact column mappings.

Operation name patterns

ARM operations follow the pattern: Microsoft.<Provider>/<resourceType>/<action>

Pattern	Examples	Detection use
`*/write`	`Microsoft.Compute/virtualMachines/write`	Resource creation/modification
`*/delete`	`Microsoft.Storage/storageAccounts/delete`	Resource destruction
`*/action`	`Microsoft.KeyVault/vaults/secrets/getSecret/action`	Privileged operations
`*/listKeys/action`	`Microsoft.Storage/storageAccounts/listKeys/action`	Credential access

2. Azure RBAC

Role hierarchy

Scope	Example	Inheritance
Management group	`/providers/Microsoft.Management/managementGroups/mg1`	Inherits down to all subscriptions
Subscription	`/subscriptions/{sub-id}`	Inherits down to all resource groups
Resource group	`/subscriptions/{sub-id}/resourceGroups/{rg}`	Inherits down to all resources
Resource	`/subscriptions/{sub-id}/resourceGroups/{rg}/providers/...`	Specific resource only

Critical built-in roles

Role	Scope	Risk	Detection signal
Owner	Any	Full control including RBAC	Role assignment at subscription/MG scope
Contributor	Any	Full control except RBAC	Resource creation/modification
User Access Administrator	Any	Can grant any role to anyone	Role assignment creation
Key Vault Administrator	Key Vault	Full secret/key/cert access	Secret access from unexpected principal
Storage Blob Data Owner	Storage	Full blob access bypassing ACLs	Data plane access
Virtual Machine Contributor	Compute	VM management including extensions	VM extension installation (code execution)

Privileged Identity Management (PIM)

PIM provides just-in-time role activation. Detection-relevant:

PIM operations in AuditLogs: Add member to role in PIM completed (permanent) vs (timebound)
Permanent role assignments bypass PIM controls — always alert
Role activation from unexpected location/device

3. Managed identities

Type	How it works	Detection relevance
System-assigned	Tied to a specific resource lifecycle	Token requests from the resource's IMDS endpoint
User-assigned	Independent lifecycle, can be shared	Can be attached to multiple resources — broader blast radius

Token acquisition

Managed identities acquire tokens via the Instance Metadata Service (IMDS) at 169.254.169.254. The token is scoped to the identity's RBAC permissions.

Detection: Managed identity tokens used from outside Azure (IMDS is only accessible from within the VM). CallerIpAddress in Activity Log should be an Azure IP for managed identity operations.

4. Key Vault

Operation	Detection signal
`SecretGet`	Secret accessed — correlate with caller identity and IP
`SecretSet`	Secret created/modified — potential credential storage
`SecretList`	Secret enumeration — reconnaissance
`KeySign` / `KeyDecrypt`	Cryptographic operations — potential data access
`CertificateGet`	Certificate accessed — potential for certificate-based auth abuse
`VaultAccessPolicyChange`	Access policy modified — privilege escalation

Key Vault data-plane operations require diagnostic settings to be enabled. Logs are exported via diagnostic settings to your SIEM (Event Hub, storage account, or Log Analytics). Without diagnostic settings, Key Vault data-plane activity is invisible.

5. Storage account security

Attack vector	Mechanism	Detection
Public blob access	Container access level set to `Blob` or `Container`	`Microsoft.Storage/storageAccounts/blobServices/containers/write` with public access
SAS token abuse	Shared Access Signature with excessive permissions/lifetime	SAS token usage from unexpected IP (storage analytics logs)
Storage key access	`listKeys` operation exposes full account access	`Microsoft.Storage/storageAccounts/listKeys/action` from non-admin
Cross-tenant replication	Object replication to external account	Replication policy creation to external destination

6. Compute operations

VM-level attacks

Operation	Detection signal
`Microsoft.Compute/virtualMachines/extensions/write`	VM extension installation — arbitrary code execution on the VM
`Microsoft.Compute/virtualMachines/runCommand/action`	Run Command — remote code execution via ARM API
`Microsoft.Compute/virtualMachines/write` (with custom data)	Custom script execution during VM creation
`Microsoft.Compute/disks/beginGetAccess/action`	Disk export — data exfiltration via disk snapshot
`Microsoft.Compute/snapshots/write` + `Microsoft.Compute/snapshots/beginGetAccess/action`	Snapshot creation + export

Serverless (Functions, Logic Apps)

Operation	Detection signal
Function deployment with external dependencies	Supply chain risk
Logic App connector creation to external services	Data exfiltration channel
Function with managed identity accessing Key Vault	Privilege chain

7. Network security

Resource	Detection-relevant operations
NSG	Rule additions allowing inbound from `0.0.0.0/0` (any) on sensitive ports
Azure Firewall	Policy modifications reducing protection
Private endpoints	Removal of private endpoints exposing services publicly
DNS zones	Record modifications (potential for DNS hijacking)
VNet peering	New peering to unexpected VNets (lateral movement path)

8. Defender for Cloud signals

Signal	Description	Detection use
Security alerts	Defender-generated threat detections	Active threat indicators
Recommendations	Misconfiguration and posture findings	Proactive risk identification
Secure Score changes	Security posture metric changes	Posture degradation tracking
Regulatory compliance	Compliance framework evaluation results	Compliance drift detection

Defender for Cloud findings are exported to your SIEM via the built-in connector or Event Hub. Consult your SIEM's Azure integration documentation for exact table names.

9. Privilege escalation paths

Azure RBAC misconfigurations and API permission abuse enable privilege escalation.

Role assignment abuse

Escalation method	Required role/permission	ARM operation	Detection signal
Assign Owner to self at subscription scope	User Access Administrator	`Microsoft.Authorization/roleAssignments/write`	Role assignment at subscription/MG scope
Assign Contributor to self	User Access Administrator	`Microsoft.Authorization/roleAssignments/write`	New role assignment from non-admin
Create custom role with wildcard actions	Owner	`Microsoft.Authorization/roleDefinitions/write`	Custom role with `*` actions
Elevate to Global Admin via subscription	Owner at root MG	`Microsoft.Authorization/elevateAccess/action`	Elevation API call — always high-signal

Compute-based escalation

Escalation method	Mechanism	ARM operation
VM extension — arbitrary code execution	Install custom script extension on VM	`Microsoft.Compute/virtualMachines/extensions/write`
Run Command — remote code execution	Execute commands via ARM API	`Microsoft.Compute/virtualMachines/runCommand/action`
Custom script during VM creation	User data / custom script extension	`Microsoft.Compute/virtualMachines/write`
Automation Account runbook	Create/modify runbook with managed identity	`Microsoft.Automation/automationAccounts/runbooks/write`
Logic App with managed identity	Create Logic App that calls ARM APIs	`Microsoft.Logic/workflows/write`
Function App with managed identity	Deploy function that uses MI to access resources	`Microsoft.Web/sites/write`

Data-plane escalation

Escalation method	Mechanism	Detection signal
Storage account key extraction	`listKeys` exposes full account access	`Microsoft.Storage/storageAccounts/listKeys/action`
Key Vault secret access	Access secrets via data plane	`SecretGet` in Key Vault diagnostic logs
Managed identity token theft	IMDS token used from outside Azure	`CallerIpAddress` is non-Azure IP for MI operations
SAS token generation with excessive scope	Generate SAS with broad permissions	Storage analytics logs — SAS usage from unexpected IP

10. Subscription and management group attacks

Attack vector	ARM operation	Detection signal
Subscription takeover	Transfer subscription to attacker tenant	`Microsoft.Subscription/cancel`, transfer operations
Management group manipulation	Move subscription between MGs	`Microsoft.Management/managementGroups/write`
Policy exemption	Exempt resources from Azure Policy	`Microsoft.Authorization/policyExemptions/write`
Resource lock removal	Remove delete locks	`Microsoft.Authorization/locks/delete`
Diagnostic settings removal	Disable logging	`Microsoft.Insights/diagnosticSettings/delete`
Blueprint assignment change	Modify governance blueprints	`Microsoft.Blueprint/blueprintAssignments/write`

11. Container and serverless attacks

AKS (Azure Kubernetes Service)

Attack vector	Detection signal
Privileged pod deployment	Kubernetes audit logs — pod spec with `privileged: true`
AKS admin credential access	`Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action`
Cluster role binding escalation	Kubernetes RBAC changes in audit logs
Container registry image poisoning	`Microsoft.ContainerRegistry/registries/push/write`
AKS managed identity abuse	MI token used for ARM operations from cluster

Azure Functions / Logic Apps

Attack vector	Detection signal
Function deployment with MI accessing Key Vault	`Microsoft.Web/sites/write` + subsequent `SecretGet`
Logic App connector to external service	`Microsoft.Logic/workflows/write` with external connector
Function with VPC integration accessing internal resources	Network-level detection via NSG flow logs
Timer-triggered function for persistence	`Microsoft.Web/sites/write` with timer trigger

12. SIEM ingestion patterns

Table/index names are SIEM-specific. Consult your SIEM's Azure integration documentation for exact table names and connector configurations.

Azure source	Telemetry type	Ingestion method	Notes
Activity Log	ARM control-plane operations	Built-in SIEM connector / Event Hub	Always available — primary detection source
Entra ID Audit + Sign-in Logs	Identity-plane operations	Built-in SIEM connector / Event Hub	See `entra-id` skill
Key Vault diagnostic logs	Data-plane secret/key/cert operations	Diagnostic settings → Event Hub / storage	Must be explicitly enabled
Storage diagnostic logs	Blob/file/queue/table operations	Diagnostic settings → Event Hub / storage	Must be explicitly enabled
NSG flow logs	Network flow metadata	Storage account → SIEM connector	Requires NSG flow log configuration
Defender for Cloud alerts	Threat detections	Built-in SIEM connector / Event Hub	Requires Defender for Cloud
Azure Policy events	Compliance and policy evaluation	Activity Log (Policy category)	Always available
AKS audit logs	Kubernetes API server audit	Diagnostic settings → Event Hub / storage	Must be explicitly enabled

microsoft-azure

Microsoft Azure — detection-relevant internals

1. Azure Activity Log