LoFP LoFP / legitimate provisioning, patching, and configuration-management automation may deploy an extension to a host for the first time. the first occurrence per host will alert. baseline expected automation principals and hosts and exclude verified-benign ones.

Techniques

Sample rules

Unusual Azure VM Extension Detected

Description

Identifies the first time a given VM extension name is created or updated on an Azure virtual machine or VM scale set within the rule’s lookback window. VM extensions run with high privilege on the guest (SYSTEM on Windows, root on Linux) and are a common code-execution and persistence primitive. The extension instance name is attacker-controlled and the Azure activity log records only that name, not the publisher or type, so the control plane cannot reliably identify the extension family (for example CustomScript). This rule therefore takes a type-agnostic ES|QL new-terms approach: it derives the host and the extension instance name from azure.resource.name and alerts the first time a given (host, extension name) pair is observed in the window, surfacing novel extension deployments while suppressing names a host routinely uses.

Detection logic

FROM logs-azure.activitylogs-*
| WHERE event.dataset == "azure.activitylogs"
    AND event.action IN (
        "MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE",
        "MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/EXTENSIONS/WRITE"
    )
    AND event.outcome IN ("success", "Success")
// azure.resource.name is "<host>/EXTENSIONS/<instance-name>"; the instance name is attacker-controlled,
// so key on the host (first path element) rather than the spoofable extension name
| EVAL Esql.vm_name = MV_FIRST(SPLIT(azure.resource.name, "/"))
| EVAL Esql.extension_name = MV_LAST(SPLIT(azure.resource.name, "/"))
| STATS Esql.first_time_seen = MIN(@timestamp),
        Esql.last_time_seen = MAX(@timestamp),
        Esql.event_count = COUNT(*),
        Esql.resource_name_values = VALUES(azure.resource.name),
        Esql.resource_id_values = VALUES(azure.resource.id),
        Esql.principal_id_values = VALUES(azure.activitylogs.identity.authorization.evidence.principal_id),
        Esql.principal_type_values = VALUES(azure.activitylogs.identity.authorization.evidence.principal_type),
        Esql.appid_values = VALUES(azure.activitylogs.identity.claims.appid),
        Esql.source_ip_values = VALUES(source.ip),
        Esql.source_as_number_values = VALUES(source.`as`.number),
        Esql.source_country_values = VALUES(source.geo.country_name),
        Esql.subscription_id_values = VALUES(azure.subscription_id)
        BY Esql.vm_name, Esql.extension_name
// new terms emulation: fire only when the (host, extension name) pair is the single occurrence in the
// 7-day window (event_count == 1) and it is recent (within the schedule interval + ingest-lag buffer)
| EVAL Esql.recent_minutes = DATE_DIFF("minute", Esql.first_time_seen, NOW())
| WHERE Esql.recent_minutes <= 10 AND Esql.event_count == 1
// surface real fields for the analyst and rule exceptions
| EVAL azure.resource.name = MV_FIRST(Esql.resource_name_values),
       azure.resource.id = MV_FIRST(Esql.resource_id_values),
       source.ip = MV_FIRST(Esql.source_ip_values)
| KEEP azure.resource.name, azure.resource.id, source.ip, Esql.*