Classification:

compliance

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when an Azure policy assignment has been created.

Strategy

Monitor Azure activity logs and detect when the @evt.name is equal to MICROSOFT.AUTHORIZATION/POLICYASSIGNMENTS/WRITE and @evt.outcome is equal to Success.

Triage and response

Inspect the policy assignment and determine if an unsolicited change was made on any Azure resources.