LoFP LoFP / the vast majority of vm writes are benign: provisioning, resizing, tagging, extension/identity changes, autoscale, and configuration management by users, service principals, and managed identities. this rule is informational only and is intended for correlation and baselining, not standalone alerting.

Techniques

Sample rules

Azure Virtual Machine Configuration Modified

Description

Identifies a successful write to an Azure virtual machine resource (“MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE”). This operation is the parent action behind VM userData injection, where an adversary with VM contributor rights writes a base64 startup payload into the VM “userData” field that executes on the next reboot (a control-plane persistence technique requiring no guest access). The Azure activity log does not record the “userData” value or which property changed, so this behavior is indistinguishable from any other VM write at detection time. This is a building block rule and does not generate alerts on its own; it captures the VM write population so it can be correlated with other signals and baselined over time to tune a higher-fidelity userData-injection detection. To investigate a candidate, retrieve the live “userData” from the VM with an Azure Resource Manager GET using “$expand=userData”.

Detection logic

data_stream.dataset:azure.activitylogs and
    event.action:"MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE" and
    event.outcome:(success or Success)